Read the docs
TI-2026-76253 Aliases CVE-2026-86791GHSA-qjmp-8h2p-7x47

Unpaid orders can be marked paid in iPOSpays WooCommerce gateway

Priority LOW 29CWE-345Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-345.

Summary

The iPOSpays Payment Gateway for WooCommerce WordPress plugin before 1.4.7 does not verify that a payment was completed before recording an order as paid (CWE-345). An unauthenticated remote attacker can mark any unpaid order as paid and rewrite its total. A public exploit is linked in the references.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

The iPOSpays Payment Gateway for WooCommerce WordPress plugin before 1.4.7 does not verify that a payment was actually completed before recording an order as paid, allowing unauthenticated users to mark any unpaid order as paid and to rewrite its total.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00114 1st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed iPOSpays Payment Gateway for WooCommerce (Unknown): 1.4.7

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
UnknowniPOSpays Payment Gateway for WooCommercebefore 1.4.71.4.7Patch availableCNA
  • iPOSpays Payment Gateway for WooCommerce VendorUnknown Affected before 1.4.7 Fixed in 1.4.7 Patch available CNA

Remediation

Update the iPOSpays Payment Gateway for WooCommerce plugin to version 1.4.7, which fixes the flaw.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA iPOSpays Payment Gateway for WooCommerce (Unknown) Fixed in 1.4.7

Timeline

  1. 2026-10-19 Threatist record created from CVE-2026-86791
  2. 2026-10-19 Weakness changed · CISA ADP
  3. 2026-10-19 CISA SSVC decision points changed
  4. 2026-10-19 Alias added: GHSA-qjmp-8h2p-7x47

References

Exploit 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences