---
id: "CVE-2026-85632"
page: "https://infrastack.ai/live/CVE-2026-85632"
kind: "vulnerability"
aliases: ["CVE-2026-85632"]
title: "Sipay WooCommerce Virtual POS Module: authentication bypass via man-in-the-middle"
severity: "critical"
cvss: 9.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "payments", "sipay", "woocommerce", "wordpress"]
not_affected_if: ["other-payment-gateway", "version-outside-range"]
published_at: "2026-11-11T15:17:25+00:00"
first_seen_at: "2026-11-11T15:27:50+00:00"
updated_at: "2026-11-11T15:29:40+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85632", "first_seen_at": "2026-11-11T15:27:50+00:00"}]
exploit_sources: []
---

# Sipay WooCommerce Virtual POS Module: authentication bypass via man-in-the-middle

Link for people: https://infrastack.ai/live/CVE-2026-85632 (this .md is for agents)

The Sipay WooCommerce Virtual POS Module skips authentication on a critical function and does not validate an integrity check value. An attacker positioned in the network path can manipulate application API messages and bypass authentication.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of the Sipay WooCommerce Virtual POS Module in the WordPress plugins list; affected versions are from `26.8.3` before `26.9.1`.

## Fix

- WooCommerce Virtual POS Module: move to `26.9.1` or later.

## Timeline

- 2026-11-11T15:27:50+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-85632

## From the sources

Missing authentication for critical function and Improper validation of integrity check value vulnerability in Sipay Electronic Money and Payment Services Inc. WooCommerce Virtual POS Module allows Authentication Bypass and Application API Message Manipulation via Man-in-the-Middle.

This issue affects WooCommerce Virtual POS Module: from 26.8.3 before 26.9.1.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_