CVE-2026-78361CWE-862broken-access-control

CVE-2026-78361

Critical · published September 10, 2026

CVSS v3.1
9.1
EPSS
0%
Percentile
38.2
In the wild
Unconfirmed
What it is

The zipMoney(Zip Co) Payments Plugin for WooCommerce WordPress plugin before 2.4.0 does not perform any authorisation checks on one of its front-end request handlers, and does not restrict which option name a caller may supply, allowing unauthenticated users to delete arbitrary WordPress options. This can be used to destroy site and access control configuration, deactivate every installed zipMoney(Zip Co) Payments Plugin for WooCommerce WordPress plugin before 2.4.0, and take the site offline.

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00451 · 38.2th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-09-10T11:17Z
References (1)
https://wpscan.com/vulnerability/8b9a00f5-d7f5-447d-b109-d15e2cde3885/ · [email protected]
EPSS history
Timeline
  • 11 SEP 03:19Z
    EPSS moved — → 0%
    epss
  • 10 SEP 06:00Z
    zipMoney(Zip Co) Payments Plugin for WooCommerce < 2.4.0 - Unauthenticated Arbitrary Option Deletion
    cvelistv5