CVE-2026-86791: iPOSpays Payment Gateway for WooCommerce < 1.4.7 - Unauthenticated Payment Confirmation Forgery
Published Oct 19, 2026
·Updated
The iPOSpays Payment Gateway for WooCommerce WordPress plugin before 1.4.7 does not verify that a payment was actually completed before recording an order as paid, allowing unauthenticated users to mark any unpaid order as paid and to rewrite its total.
Affected Software
1 affected component
iPOSpays Payment Gateway for WooCommerce<1.4.7
Event History
Oct 19, 2026
CVE Published
via MITRE·06:46 AM
Data Sourced
via MITRE·06:46 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·07:16 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which installations are affected?
Installations using iPOSpays Payment Gateway for WooCommerce versions earlier than 1.4.7 are affected.
2
Does exploitation require an account or user interaction?
No. The issue can be exploited by an unauthenticated user and does not require user interaction.
3
What can an attacker do?
An attacker can cause an unpaid order to be recorded as paid and can rewrite that order's total. The provided severity vector indicates integrity impact, with no stated confidentiality or availability impact.