What is the CVSS score of CVE-2026-4663?

CVE-2026-4663 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.1%.

iPOSpays Gateways WC CVE-2026-4663

EUVD-2026-29394 MEDIUM

Missing Authorization (CWE-862)

2026-05-12 Wordfence

GHSA-9v2v-8mq8-p8ff

WordPress Authentication Bypass Ipospays Gateways Wc Wordpress Plugin

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 12, 2026 - 08:48 vuln.today

CVE Published

May 12, 2026 - 07:48 nvd

MEDIUM 5.3

DescriptionCVE.org

The iPOSpays Gateways WC plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 1.3.7. This is due to the plugin exposing a REST API endpoint /wp-json/ipospays/v1/save_settings with 'permission_callback' set to '__return_true', which allows unauthenticated access without any capability checks or nonce verification. This makes it possible for unauthenticated attackers to update plugin settings, specifically allowing them to overwrite critical payment gateway settings including live API keys, secret keys, and payment tokens stored in the 'woocommerce_ipospays_settings' option.

AnalysisAI

Unauthenticated attackers can modify critical payment gateway settings in the iPOSpays Gateways WC WordPress plugin through an exposed REST API endpoint lacking authorization checks, enabling them to overwrite live API keys, secret keys, and payment tokens. Affected versions up to 1.3.7 permit unrestricted access to the /wp-json/ipospays/v1/save_settings endpoint due to a permission_callback set to '__return_true' with no nonce verification, allowing complete compromise of payment processing credentials without authentication. This is a high-integrity attack vector against e-commerce sites using the plugin.

Technical ContextAI

The iPOSpays Gateways WC plugin is a WordPress payment gateway integration for WooCommerce that processes payments through the iPOSpays platform. The vulnerability exists in the REST API endpoint registration within class-ftd-redirect-gateway.php, where the 'permission_callback' parameter is hardcoded to return true instead of validating user capabilities (such as 'manage_options') or verifying WordPress nonce tokens. The plugin stores sensitive payment gateway credentials-including API keys, secret keys, and payment tokens-in the WordPress options table under 'woocommerce_ipospays_settings'. CWE-862 (Missing Authorization) represents the root cause: the endpoint performs sensitive write operations (settings updates) without verifying the requester's identity or privileges. WordPress REST API endpoints should enforce authorization via 'permission_callback' functions that check user roles and nonces; this plugin bypasses that security mechanism entirely.

RemediationAI

Update the iPOSpays Gateways WC plugin to a patched version released after 1.3.7. As an immediate temporary measure if an update is not yet available, disable REST API access to the /wp-json/ipospays/v1/ endpoints by adding the following to wp-config.php: define( 'REST_API_ENABLED', false ); or apply a web application firewall (WAF) rule to block POST requests to /wp-json/ipospays/v1/save_settings. These workarounds will prevent the exploit but will also disable the plugin's REST API functionality and require re-enabling after patching. Check the Wordfence vulnerability page (https://www.wordfence.com/threat-intel/vulnerabilities/id/a1a30930-31c1-4254-867c-073932672a39) for patch availability and version details. If credentials are suspected to have been compromised, regenerate all iPOSpays API keys and secret keys in the payment processor's dashboard immediately.