CVE-2026-97259

WordPress Pay with Vipps for WooCommerce plugin <= 6.2.4 - Insecure Direct Object References (IDOR) vulnerability

Published Sep 30, 2026 CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Description

Authorization Bypass Through User-Controlled Key vulnerability in WP Hosting AS Pay with Vipps for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.

This issue affects Pay with Vipps for WooCommerce: from n/a through 6.2.4.

Analysis

Technical impact

The vulnerability is an Insecure Direct Object Reference that allows an attacker to bypass authorization controls by supplying a user‑controlled key. This can lead to unauthorized retrieval or modification of sensitive data that belongs to other users. The weakness is classified as CWE‑639 and poses a moderate risk of privilege escalation within the affected application.

Affected Systems

WordPress Pay with Vipps for WooCommerce plugins developed by WP Hosting AS are affected. All versions up through 6.2.4 (inclusive) are vulnerable and should be considered at risk. Versions 6.2.5 and later contain the remediation.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity. EPSS data is not available. The vulnerability is not listed in CISA KEV. The likely attack vector is an attacker sending crafted HTTP requests that include a user‑controlled identifier to access resources belonging to other users; authenticated sessions may be required to exploit the IDOR. The CVE description confirms that access control is incorrectly configured, enabling the bypass without additional privileges.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

WP Hosting AS

Pay with Vipps for WooCommerce

unaffected

Version	Status	Constraints
`n/a`	affected	≤ 6.2.4

No data.

No data available yet.

Remediation

Vendor Solution

Update the WordPress Pay with Vipps and MobilePay for WooCommerce plugin to the latest available version (at least 6.2.5).

OpenCVE Recommended Actions

Update the WordPress Pay with Vipps for WooCommerce plugin to version 6.2.5 or later.
If an immediate update is not possible, enforce server‑side validation to confirm the object identifier belongs to the authenticated user and remove direct exposure of object identifiers in URLs.
Review access logs for repeated attempts to request unauthorized resources and adjust permissions or audit user activity accordingly.

Generated by OpenCVE AI on September 30, 2026 at 17:02 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.213% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://patchstack.com/database/wordpress/plugin/woo-vipps/vulnerability/wordpress-pay-with-vipps-for-woocommerce-plugin-6-2-4-insecure-direct-object-references-idor-vulnerability?_s_id=cve

History

Nov 10, 2026 9:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sep 30, 2026 2:30 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Authorization Bypass Through User-Controlled Key vulnerability in WP Hosting AS Pay with Vipps for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Pay with Vipps for WooCommerce: from n/a through 6.2.4.
Title		WordPress Pay with Vipps for WooCommerce plugin <= 6.2.4 - Insecure Direct Object References (IDOR) vulnerability
Weaknesses		CWE-639
References		https://patchstack.com/database/wordpress/plugin/woo-vipps/vulnerability/wordpress-pay-with-vipps-for-woocommerce-plugin-6-2-4-insecure-direct-object-references-idor-vulnerability?_s_id=cve
Metrics		cvssV4_0 `{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N'}`