Zipmoney Zip Co Payments Plugin For Woocommerce
Monthly
Unauthenticated arbitrary WordPress option deletion in the zipMoney (Zip Co) Payments Plugin for WooCommerce before 2.4.0 lets remote attackers destroy site configuration and take the site offline. One front-end request handler performs no authorization checks and does not restrict which option name the caller supplies, so any unauthenticated visitor can delete critical wp_options entries. Publicly available exploit code exists and a vendor patch (2.4.0) is available; no active exploitation has been confirmed (not in CISA KEV).
Unauthenticated arbitrary WordPress option deletion in the zipMoney (Zip Co) Payments Plugin for WooCommerce before 2.4.0 lets remote attackers destroy site configuration and take the site offline. One front-end request handler performs no authorization checks and does not restrict which option name the caller supplies, so any unauthenticated visitor can delete critical wp_options entries. Publicly available exploit code exists and a vendor patch (2.4.0) is available; no active exploitation has been confirmed (not in CISA KEV).