Security Alert Summary
The zipMoney(Zip Co) Payments Plugin for WooCommerce (before 2.4.0) contains a vulnerability that allows unauthenticated attackers to delete arbitrary WordPress options via a front-end request handler that lacks authorization checks and does not restrict the option name parameter. Successful exploitation can remove site configuration and access-control settings, deactivate the plugin instances, and potentially take the site offline.
CVE Details
- CVE ID:
CVE-2026-78361 - Affected component: zipMoney(Zip Co) Payments Plugin for WooCommerce (plugin front-end request handler)
- Affected versions: versions less than 2.4.0
- Published: September 10, 2026 at 7:17:03 AM
- Last modified: September 10, 2026 at 3:13:07 PM
- CVSS v3.1 base score: 9.1
- CVSS v3.1 severity: CRITICAL
- CVSS v3.1 vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H - Authentication / Privileges / User interaction:
- Authentication required: None
- Privileges required: None
- User interaction: None
- Primary impact:
- Confidentiality: None
- Integrity: High
- Availability: High
- CWE / weakness ID: CWE-862 (Missing Authorization)
Technical Details
According to the vulnerability description, a front-end request handler in the plugin does not perform authorization checks and does not restrict which option name a caller may supply. Because WordPress options control site and access configuration, an unauthenticated attacker can delete arbitrary options by calling the vulnerable handler with a chosen option name. The description explicitly states this can be used to destroy site and access control configuration, deactivate every installed instance of the plugin, and take the site offline.
No specific function names or REST endpoints are provided in the available data. The core issue is a missing authorization check on a front-end handler combined with insufficient validation of the target option name parameter, which together enable unauthenticated modification (deletion) of persistent site configuration.
Impact is limited to integrity and availability of configuration and service; there is no indication in the provided data of direct confidential data disclosure.
How This Could Impact Your Website
Consider a small ecommerce site using this plugin. The site owner, a site editor who manages products, and an external contractor who performs occasional theme or integration work all have distinct roles. An unauthenticated attacker exploiting this issue could delete options that control plugin activation, payment gateway configuration, or access rules. Practical consequences include:
- Deactivation of the zipMoney(Zip Co) Payments Plugin for WooCommerce across the site, preventing customers from completing payments through that gateway.
- Loss of site configuration that could require manual restoration from backups or reconfiguration by staff or contractors, causing downtime.
- Operational disruption that increases the chance of successful social engineering or targeted scams due to confusion or altered site behavior.
While the CVSS data indicates confidentiality impact is NONE (no direct data disclosure), integrity and availability impacts are HIGH, so outages and configuration loss are realistic outcomes. If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Until a patch is applied, restrict public access to any front-end endpoints that interact with plugin configuration where feasible (for example, via web application firewall rules or server access controls).
- Review and reduce unnecessary user roles, especially contributors and accounts with elevated capabilities.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your site.
- Monitor site activity and logs for unusual behavior, such as sudden option deletions, unexpected plugin deactivations, or configuration changes.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
