{"id":"CVE-2026-85632","kind":"vulnerability","aliases":["CVE-2026-85632"],"related":[],"title":"Sipay WooCommerce Virtual POS Module: authentication bypass via man-in-the-middle","description":"Missing authentication for critical function and Improper validation of integrity check value vulnerability in Sipay Electronic Money and Payment Services Inc. WooCommerce Virtual POS Module allows Authentication Bypass and Application API Message Manipulation via Man-in-the-Middle.\n\nThis issue affects WooCommerce Virtual POS Module: from 26.8.3 before 26.9.1.","summary":"The Sipay WooCommerce Virtual POS Module skips authentication on a critical function and does not validate an integrity check value. An attacker positioned in the network path can manipulate application API messages and bypass authentication.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","payments","sipay","woocommerce","wordpress"],"not_affected_if":["other-payment-gateway","version-outside-range"],"how_to_check":"- Check the installed version of the Sipay WooCommerce Virtual POS Module in the WordPress plugins list; affected versions are from `26.8.3` before `26.9.1`.","fix":"- WooCommerce Virtual POS Module: move to `26.9.1` or later.","status":"open","published_at":"2026-11-11T15:17:25+00:00","first_seen_at":"2026-11-11T15:27:50+00:00","triaged_at":"2026-11-11T15:29:40+00:00","updated_at":"2026-11-11T15:29:40+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-11T15:29:40Z","model":"claude-haiku-5-5","output":{"fix":"- WooCommerce Virtual POS Module: move to `26.9.1` or later.","reach":"network","title":"Sipay WooCommerce Virtual POS Module: authentication bypass via man-in-the-middle","impact":"high","summary":"The Sipay WooCommerce Virtual POS Module skips authentication on a critical function and does not validate an integrity check value. An attacker positioned in the network path can manipulate application API messages and bypass authentication.","audience":"businesses","category":"package","nicknames":[],"who_cares":["woocommerce","wordpress","payments","sipay"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"attacker bypasses payment API authentication and manipulates transaction messages","analyst_note":"","how_to_check":"- Check the installed version of the Sipay WooCommerce Virtual POS Module in the WordPress plugins list; affected versions are from `26.8.3` before `26.9.1`.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["other-payment-gateway","version-outside-range"],"who_is_affected":"Online stores running the Sipay WooCommerce Virtual POS Module between versions 26.8.3 and 26.9.1 are exposed, since the flaw lies in how payment API messages are handled between the store and the payment provider. Stores not using this module, or running a version outside that range, are not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.00072,"input_tokens":4581,"output_tokens":523,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-85632':16A,19A '26.8.3':107C '26.9.1':109C 'affect':101C 'allow':85C 'api':55B,90C 'applic':54B,89C 'attack':46B 'authent':6A,32B,59B,61C,86C 'bypass':7A,58B,87C 'check':43B,70C 'critic':35B,63C 'cve':14A,17A 'electron':75C 'function':36B,64C 'improp':66C 'inc':80C 'integr':42B,69C 'issu':100C 'man':10A,95C 'man-in-the-middl':9A,94C 'manipul':53B,92C 'messag':56B,91C 'middl':13A,98C 'miss':60C 'modul':5A,30B,84C,105C 'money':76C 'network':50B 'packag':20B 'path':51B 'payment':21B,78C 'pos':4A,29B,83C,104C 'posit':47B 'servic':79C 'sipay':1A,22B,26B,74C 'skip':31B 'valid':40B,67C 'valu':44B,71C 'via':8A,93C 'virtual':3A,28B,82C,103C 'vulner':72C 'woocommerc':2A,23B,27B,81C,102C 'wordpress':24B","nicknames":[],"mitigations":[],"who_affected":"Online stores running the Sipay WooCommerce Virtual POS Module between versions 26.8.3 and 26.9.1 are exposed, since the flaw lies in how payment API messages are handled between the store and the payment provider. Stores not using this module, or running a version outside that range, are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["critical","package","payments","sipay","woocommerce","wordpress"],"campaign_type":null,"search_a":"'-2026':15A,18A '-85632':16A,19A 'authent':6A 'bypass':7A 'cve':14A,17A 'man':10A 'man-in-the-middl':9A 'middl':13A 'modul':5A 'pos':4A 'sipay':1A 'via':8A 'virtual':3A 'woocommerc':2A","search_b":"'api':55B 'applic':54B 'attack':46B 'authent':32B,59B 'bypass':58B 'check':43B 'critic':35B 'function':36B 'integr':42B 'manipul':53B 'messag':56B 'modul':30B 'network':50B 'packag':20B 'path':51B 'payment':21B 'pos':29B 'posit':47B 'sipay':22B,26B 'skip':31B 'valid':40B 'valu':44B 'virtual':28B 'woocommerc':23B,27B 'wordpress':24B","search_c":"'26.8.3':107C '26.9.1':109C 'affect':101C 'allow':85C 'api':90C 'applic':89C 'authent':61C,86C 'bypass':87C 'check':70C 'critic':63C 'electron':75C 'function':64C 'improp':66C 'inc':80C 'integr':69C 'issu':100C 'man':95C 'man-in-the-middl':94C 'manipul':92C 'messag':91C 'middl':98C 'miss':60C 'modul':84C,105C 'money':76C 'payment':78C 'pos':83C,104C 'servic':79C 'sipay':74C 'valid':67C 'valu':71C 'via':93C 'virtual':82C,103C 'vulner':72C 'woocommerc':81C,102C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T15:17:25+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cvss_by":"iletisim@usom.gov.tr","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-85632","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85632","severity":null,"published_at":"2026-11-11T15:17:25+00:00","modified_at":"2026-11-11T15:17:25+00:00","first_seen_at":"2026-11-11T15:27:50+00:00","fetched_at":"2026-11-11T15:27:50+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}