The OpenCart Virtual POS Module from Sipay Electronic Money and Payment Services Inc. implements cryptographic signature verification incorrectly. As a result, an attacker can forge a payment request’s digital signature that the module accepts, bypassing the payment validation step. This flaw enables unauthorized payment transactions, allowing an adversary to redirect funds, create fraudulent orders, or otherwise manipulate transaction records, which can lead to significant financial loss for merchants and end‑users.

Vulnerable systems are the OpenCart Virtual POS Module versions prior to 26.9.1. Specifically, any instance of the module deployed between the 26.8.2 release and the 26.9.1 release is affected. The product is provided by Sipay Electronic Money and Payment Services Inc. and is typically integrated into online storefronts that use OpenCart 3.x.

The CVSS score of 9.8 indicates a high impact and low attack complexity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting that no widespread exploitation has been publicly reported. The likely attack vector is remote, involving a crafted payment request with a spoofed signature sent to the POS API. Based on the description, it is inferred that no local privileges or special access beyond the ability to interact with the POS API are required for exploitation.