Paper/Archive/CVE-2026-78361

CVE-2026-78361

Unknown zipMoney(Zip Co) Payments Plugin for WooCommerce — zipMoney(Zip Co) Payments Plugin for WooCommerce < 2.4.0 - Unauthenticated Arbitrary Option Deletion

EPSS 0.5%CVSS 9.1

critical.is priorityof 100

CVSS 9.1 (ADP)9.1 / 10 × 3027.3 Not in CISA KEV+300.0 EPSS percentile 39.2.392 × 207.8 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

The zipMoney(Zip Co) Payments Plugin for WooCommerce WordPress plugin before 2.4.0 does not perform any authorisation checks on one of its front-end request handlers, and does not restrict which option name a caller may supply, allowing unauthenticated users to delete arbitrary WordPress options. This can be used to destroy site and access control configuration, deactivate every installed zipMoney(Zip Co) Payments Plugin for WooCommerce WordPress plugin before 2.4.0, and take the site offline.

Affected

ProductAffectedFixed inSource

zipMoney(Zip Co) Payments Plugin for WooCommerce< 2.4.02.4.0CNA

Scores by source

CISA ADP9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

exploitwpscan.com/vulnerability/8b9a00f5-d7f5-447d-b109-d15e2cde3885