** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-39608. Reason: This candidate is a reservation duplicate of CVE-2026-39608. Notes: All CVE users should reference CVE-2026-39608 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
Description
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-39608. Reason: This candidate is a reservation duplicate of CVE-2026-39608. Notes: All CVE users should reference CVE-2026-39608 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
Published:
2026-05-12
Score:
n/a
EPSS:
n/a
KEV:
No
Impact:
n/a
Action:
n/a
Analysis
No data.
No data.
| Vendor | Product | Confidence | Versions | ||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
| Ipospays | Ipospays Gateways Wc | 100% |
|
||||||||
| Wordpress | Wordpress | 80% |
|
Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .
Remediation
No vendor fix or workaround currently provided.
OpenCVE Recommended Actions
- Update the iPOSpays Gateways WC plugin to a version that removes the unauthenticated REST endpoint or adds proper permission checks.
- If an update is not immediately possible, disable or remove the /wp-json/ipospays/v1/save_settings route by modifying the plugin code or adding a custom filter that blocks the route for unauthenticated requests.
- After applying the fix, audit the woocommerce_ipospays_settings option to ensure no unauthorized or malicious payment gateway configuration values remain.
Generated by OpenCVE AI on May 12, 2026 at 10:28 UTC.
Tracking
Sign in to view the affected projects.
Advisories
No advisories yet.
References
No reference.
History
Mon, 18 May 2026 16:30:00 +0000
Mon, 18 May 2026 15:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | The iPOSpays Gateways WC plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 1.3.7. This is due to the plugin exposing a REST API endpoint /wp-json/ipospays/v1/save_settings with 'permission_callback' set to '__return_true', which allows unauthenticated access without any capability checks or nonce verification. This makes it possible for unauthenticated attackers to update plugin settings, specifically allowing them to overwrite critical payment gateway settings including live API keys, secret keys, and payment tokens stored in the 'woocommerce_ipospays_settings' option. | ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-39608. Reason: This candidate is a reservation duplicate of CVE-2026-39608. Notes: All CVE users should reference CVE-2026-39608 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. |
Tue, 12 May 2026 22:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Tue, 12 May 2026 12:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Ipospays
Ipospays ipospays Gateways Wc Wordpress Wordpress wordpress |
|
| Vendors & Products |
Ipospays
Ipospays ipospays Gateways Wc Wordpress Wordpress wordpress |
Tue, 12 May 2026 08:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | The iPOSpays Gateways WC plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 1.3.7. This is due to the plugin exposing a REST API endpoint /wp-json/ipospays/v1/save_settings with 'permission_callback' set to '__return_true', which allows unauthenticated access without any capability checks or nonce verification. This makes it possible for unauthenticated attackers to update plugin settings, specifically allowing them to overwrite critical payment gateway settings including live API keys, secret keys, and payment tokens stored in the 'woocommerce_ipospays_settings' option. | |
| Title | iPOSpays Gateways WC <= 1.3.7 - Unauthenticated Missing Authorization to Settings Update via REST API Endpoint | |
| Weaknesses | CWE-862 | |
| References |
|
|
| Metrics |
cvssV3_1
|
MITRE
Status: REJECTED
Assigner: Wordfence
Published:
Updated: 2026-05-18T14:22:46.082Z
Reserved: 2026-03-23T16:19:41.095Z
Link: CVE-2026-4663
Vulnrichment
Updated:
NVD
Status : Rejected
Published: 2026-05-12T09:16:41.900
Modified: 2026-05-18T16:16:32.350
Link: CVE-2026-4663
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-05-12T11:45:14Z
Weaknesses
No weakness.