iPOSpays Payment Gateway EUVD-2026-104100

Requires the iPOSpays Payment Gateway for WooCommerce plugin (version before 1.4.7) to be installed and active as a configured payment method on a WooCommerce store; exploitation targets the plugin's payment-confirmation handling, which fails to verify that payment actually completed. No authentication, user interaction, or special privileges are needed (PR:N/UI:N), and default configurations are affected once the gateway is enabled. The main limiting factor is deployment scope - only stores actively using this specific gateway are exposed - and the impact is confined to order/payment integrity (no data exposure or downtime).

This is a business-logic / improper-authorization flaw with a modest CVSS 3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) - network-reachable, low-complexity, and unauthenticated (PR:N), but with only limited integrity impact and no confidentiality or availability impact. The practical severity is arguably understated by the numeric score: an attacker can mark arbitrary unpaid orders as paid and rewrite order totals, which translates directly into payment fraud and revenue loss for merchants even though CVSS only rates it 'Low' integrity. Signals are consistent rather than conflicting: the C:N in the vector agrees that no data is disclosed, which contradicts the 'Information Disclosure' tag applied in the input (the real weakness is a missing payment-verification check / broken access control). Publicly available exploit code exists (reported by WPScan), raising near-term exploitation feasibility, but there is NO CISA KEV listing and NO EPSS score was provided, so there is no evidence of active or widespread exploitation yet. Net assessment: a genuine priority for the specific merchants running this gateway because exploitation is trivial, unauthenticated, and monetizable, but low blast radius overall due to the plugin's limited deployment footprint.

An unauthenticated attacker places an order through a WooCommerce store using the iPOSpays gateway, then sends a crafted request to the plugin's order-confirmation/callback handler that the plugin trusts without verifying an actual payment occurred. The store records the order as paid - optionally with an attacker-chosen total - so goods or services are released without payment. Public exploit code for this flaw is available via WPScan, lowering the skill required.