Sipay WooCommerce Virtual POS Module: Authentication bypass via man-in-the-middle
Summary
The Sipay WooCommerce Virtual POS Module, a WordPress plugin for card payments in online shops, lacks authentication for a critical function and does not properly validate an integrity check value. A network attacker positioned as a man-in-the-middle on the traffic between the shop and the payment flow can bypass authentication and manipulate application API messages, including payment status. The CNA rates the issue as critical (CVSS 9.1).
Affected
- WooCommerce Virtual POS Module from 26.8.3 before 26.9.1
- Versions before 26.8.3: Unknown.
Fixed in
- Upgrade to version 26.9.1 or later.
Workaround
- Unknown. No workaround is listed in the sources checked; upgrading to 26.9.1 is the only fix.
Exploitation
- No known exploitation in the wild (Radar lists it as not known to be exploited; no CISA KEV entry found).
- No public proof of concept or exploit code found.
- VulDB labels the entry as 0-Day, meaning it was not publicly known before disclosure.
Our recommendation
- Identify all WooCommerce shops running Sipay Virtual POS and record their versions.
- Upgrade every installation on 26.8.3 up to 26.9.0 to 26.9.1.
- Check recent payment and order records against the payment provider's transaction records.
- Ask Sipay to confirm the affected range, including whether earlier versions are affected.
- Check other Sipay shop modules (PrestaShop, OpenCart) for the related critical CVE-2026-86405 and CVE-2026-85531, fixed in 26.9.1.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE Record CVE-2026-85632 www.cve.org
- TR-CERT advisory tr-26-1520 siberguvenlik.gov.tr
- VulDB entry 435836 vuldb.com
- Radar Offseq CVE-2026-85632 radar.offseq.com
- NVD mirror CVE-2026-85632 (threatint) cve.threatint.com
- Ionix CVE-2026-86405 (PrestaShop module) www.ionix.io
- GitHub advisory GHSA-9f78-prj9-gr67 (OpenCart module, CVE-2026-85531) github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 16:21.
Original description (NVD)
Missing authentication for critical function and Improper validation of integrity check value vulnerability in Sipay Electronic Money and Payment Services Inc. WooCommerce Virtual POS Module allows Authentication Bypass and Application API Message Manipulation via Man-in-the-Middle. This issue affects WooCommerce Virtual POS Module: from 26.8.3 before 26.9.1.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.