PT-2026-39949 · WordPress · Ipospays Gateways Wc

Alexis Lafontaine · Published 2026-05-12 · Updated 2026-05-12 · CVE-2026-4663

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions iPOSpays Gateways WC versions prior to 1.3.8

Description The plugin contains a missing authorization flaw due to the REST API endpoint "/wp-json/ipospays/v1/save settings" having its permission callback set to return true. This configuration allows unauthenticated access without capability checks or nonce verification, enabling attackers to update plugin settings. Specifically, critical payment gateway settings, including live API keys, secret keys, and payment tokens stored in the woocommerce ipospays settings option, can be overwritten.

Recommendations Update the plugin to a version later than 1.3.7. As a temporary workaround, restrict access to the "/wp-json/ipospays/v1/save settings" endpoint to minimize the risk of exploitation.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-4663

Affected Products

Ipospays Gateways Wc

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-4663 · Security Note
• https://t.me/cveNotify/163223 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/a1a30930-31c1-4254-867c-073932672a39?source=cve · Note
• https://plugins.trac.wordpress.org/browser/ipospays-gateways-wc/trunk/includes/payment-methods/class-ftd-redirect-gateway.php#L253 · Note
• https://plugins.trac.wordpress.org/browser/ipospays-gateways-wc/trunk/includes/payment-methods/class-ftd-redirect-gateway.php#L336 · Note
• https://plugins.trac.wordpress.org/browser/ipospays-gateways-wc/tags/1.3.7/includes/payment-methods/class-ftd-redirect-gateway.php#L253 · Note
• https://plugins.trac.wordpress.org/browser/ipospays-gateways-wc/tags/1.3.7/includes/payment-methods/class-ftd-redirect-gateway.php#L336 · Note
• https://plugins.trac.wordpress.org/browser/ipospays-gateways-wc/tags/1.3.7/includes/payment-methods/class-ftd-redirect-gateway.php#L381 · Note
• https://plugins.trac.wordpress.org/browser/ipospays-gateways-wc/trunk/includes/payment-methods/class-ftd-redirect-gateway.php#L381 · Note