Paper/Archive/CVE-2026-85632

CVE-2026-85632

Sipay Electronic Money and Payment Services Inc. WooCommerce Virtual POS Module — Unauthenticated Payment Status Manipulation in Sipay Electronic Money's WordPress (WooCommerce)

CVSS 9.1

critical.is priorityof 100

CVSS 9.1 (CNA)9.1 / 10 × 3027.3 Not in CISA KEV+300.0 No EPSS score.000 × 200.0 No public exploit+100.0 SSVC exploitation: unknown+100.0

Description · from the CVE record

Missing authentication for critical function and Improper validation of integrity check value vulnerability in Sipay Electronic Money and Payment Services Inc. WooCommerce Virtual POS Module allows Authentication Bypass and Application API Message Manipulation via Man-in-the-Middle. This issue affects WooCommerce Virtual POS Module: from 26.8.3 before 26.9.1.

Affected

ProductAffectedFixed inSource

WooCommerce Virtual POS Module26.8.3 – < 26.9.126.9.1CNA

Scores by source

TR-CERT (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References

refsiberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1520