Authentication Bypass Vulnerability in WooCommerce Virtual POS Module by Sipay Electronic Money and Payment Services Inc.
CVE-2026-85632

9.1CRITICAL

Key Information:

Vendor

WordPress
Status
WooCommerce Virtual Pos Module
Vendor
CVE Published:
11 November 2026

What is CVE-2026-85632?

A vulnerability exists in the WooCommerce Virtual POS Module developed by Sipay Electronic Money and Payment Services Inc., allowing attackers to bypass authentication mechanisms. This flaw is due to missing validation processes for critical functions, enabling unauthorized access and manipulation of API messages. Exploiting this vulnerability could lead to serious implications for payment integrity and security, particularly in e-commerce transactions.

Affected Version(s)

WooCommerce Virtual POS Module 26.8.3 < 26.9.1

References

https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/...
government-resource

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Yasin SUER
.