CVE-2026-78361
zipMoney(Zip Co) Payments Plugin for WooCommerce < 2.4.0 - Unauthenticated Arbitrary Option Deletion
CVSS Score
9.1
EPSS Score
0.0%
EPSS Percentile
0th
The zipMoney(Zip Co) Payments Plugin for WooCommerce WordPress plugin before 2.4.0 does not perform any authorisation checks on one of its front-end request handlers, and does not restrict which option name a caller may supply, allowing unauthenticated users to delete arbitrary WordPress options. This can be used to destroy site and access control configuration, deactivate every installed zipMoney(Zip Co) Payments Plugin for WooCommerce WordPress plugin before 2.4.0, and take the site offline.
| Vendor | unknown |
| Product | zipmoney(zip co) payments plugin for woocommerce |
| Published | Sep 10, 2026 |
| Last Updated | Sep 10, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown zipmoney(zip co) payments plugin for woocommerce
Be the first to know when new critical vulnerabilities affecting unknown zipmoney(zip co) payments plugin for woocommerce are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / zipMoney(Zip Co) Payments Plugin for WooCommerce
0 < 2.4.0
References
Credits
Naoki Kawahigashi WPScan