CVE-2026-97259: WordPress Pay with Vipps for WooCommerce plugin <= 6.2.4 - Insecure Direct Object References (IDOR) vulnerability
Authorization Bypass Through User-Controlled Key vulnerability in WP Hosting AS Pay with Vipps for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.
This issue affects Pay with Vipps for WooCommerce: from n/a through 6.2.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Pay with Vipps and MobilePay for WooCommerceto a version that resolves this vulnerability.Fixed in 6.2.5
Event History
Frequently Asked Questions
Which installations are affected?
Pay with Vipps for WooCommerce installations running version 6.2.4 or earlier are affected. The available data does not identify a version in which the issue is fixed.
What access does an attacker need to exploit this issue?
The issue is described as an authorization bypass through a user-controlled key and incorrectly configured access-control levels. The available data does not state whether authentication, a particular WordPress role, or any other prerequisite is required.
What can be done if patching is not immediately possible?
No specific workaround or mitigation is provided in the available data. Restrict access to the affected functionality where possible until an update or vendor guidance is available.