zipMoney Payments Plugin EUVD-2026-75265

Exploitation requires only that a target run the zipMoney (Zip Co) Payments Plugin for WooCommerce at a version below 2.4.0 with its vulnerable front-end request handler reachable - the default state. No authentication, no user interaction, and no special configuration are needed (PR:N/UI:N); the attacker simply supplies an arbitrary option name to the unprotected handler. The only meaningful limit on exploitation is plugin presence and version: sites on 2.4.0+ or without the plugin are unaffected, and the impact is destruction/availability (integrity and availability) rather than data theft.

The signals are mixed but lean toward genuine priority within affected installations. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:N/I:H/A:H, score 9.1) describes trivial remote unauthenticated exploitation with high integrity and availability impact but no confidentiality loss, which matches the description precisely. SSVC reports Exploitation: none (no observed in-the-wild activity), Automatable: yes (reconnaissance and exploitation can be scripted across many sites), and Technical Impact: partial - the 'partial' rating is arguably conservative given that deleting access-control options can take an entire site offline. Publicly available exploit code raises real-world risk, though POC availability is distinct from active exploitation, which is not confirmed (not in CISA KEV). EPSS is not provided in the input. The dominant limiting factor is footprint: this is a niche regional payment plugin, so automatable mass exploitation is bounded by how many sites actually run it.

An attacker scans WordPress sites for the vulnerable plugin, then sends a single crafted unauthenticated front-end request invoking the handler with option names such as the active_plugins or site access-control entries. The plugin deletes those options without any authorization check, deactivating the plugin fleet-wide and corrupting site configuration so the site goes offline. Public exploit code exists, making this scriptable at scale.