EUVD-2026-75265
GHSA-rx27-rpmw-vv8g
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Remote unauthenticated request with no interaction deletes arbitrary options (I:H) and can take the site offline (A:H); no data disclosure so C:N.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The zipMoney(Zip Co) Payments Plugin for WooCommerce WordPress plugin before 2.4.0 does not perform any authorisation checks on one of its front-end request handlers, and does not restrict which option name a caller may supply, allowing unauthenticated users to delete arbitrary WordPress options. This can be used to destroy site and access control configuration, deactivate every installed zipMoney(Zip Co) Payments Plugin for WooCommerce WordPress plugin before 2.4.0, and take the site offline.
Articles & Coverage 1
AnalysisAI
Unauthenticated arbitrary WordPress option deletion in the zipMoney (Zip Co) Payments Plugin for WooCommerce before 2.4.0 lets remote attackers destroy site configuration and take the site offline. One front-end request handler performs no authorization checks and does not restrict which option name the caller supplies, so any unauthenticated visitor can delete critical wp_options entries. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires only that a target run the zipMoney (Zip Co) Payments Plugin for WooCommerce at a version below 2.4.0 with its vulnerable front-end request handler reachable - the default state. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals are mixed but lean toward genuine priority within affected installations. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the primary fix by upgrading to zipMoney (Zip Co) Payments Plugin for WooCommerce 2.4.0 or later (Vendor-released patch: 2.4.0), which adds the missing authorization/nonce check on the request handler. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all WooCommerce instances running the zipMoney plugin and disable it on any instance running versions prior to 2.4.0 until patching is possible. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today