WordPress · Ipospays Gateways Wc · CVE-2026-4663
**Name of the Vulnerable Software and Affected Versions**
iPOSpays Gateways WC versions prior to 1.3.8
**Description**
The plugin contains a missing authorization flaw due to the REST API endpoint "/wp-json/ipospays/v1/save settings" having its `permission callback` set to ` return true`. This configuration allows unauthenticated access without capability checks or nonce verification, enabling attackers to update plugin settings. Specifically, critical payment gateway settings, including live API keys, secret keys, and payment tokens stored in the `woocommerce ipospays settings` option, can be overwritten.
**Recommendations**
Update the plugin to a version later than 1.3.7.
As a temporary workaround, restrict access to the "/wp-json/ipospays/v1/save settings" endpoint to minimize the risk of exploitation.