Missing Authorization Vulnerability in iPOSpays Gateways WC Plugin by WordPress

CVE-2026-4663

What is CVE-2026-4663?

The iPOSpays Gateways WC plugin exposes a REST API endpoint that allows unauthenticated access without necessary checks or nonce verification. This vulnerability enables attackers to modify critical payment gateway settings, including API keys, secret keys, and payment tokens, by invoking the endpoint at /wp-json/ipospays/v1/save_settings. As a result, sensitive financial information may be compromised, leading to potential payment fraud.

References