CVE-2026-78361 in zipMoney Payments Plugin for WooCommerce Plugin
Summary
by MITRE • 09/10/2026
The zipMoney(Zip Co) Payments Plugin for WooCommerce WordPress plugin before 2.4.0 does not perform any authorisation checks on one of its front-end request handlers, and does not restrict which option name a caller may supply, allowing unauthenticated users to delete arbitrary WordPress options. This can be used to destroy site and access control configuration, deactivate every installed zipMoney(Zip Co) Payments Plugin for WooCommerce WordPress plugin before 2.4.0, and take the site offline.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/10/2026
The vulnerability identified in versions of the Zip Money (Zip Co) Payments Plugin for WooCommerce prior to version 2.4.0 represents a critical failure in access control mechanisms within the application's front-end request handling logic. This flaw allows unauthenticated attackers to perform administrative actions that should be restricted to users with elevated privileges, specifically by manipulating WordPress option data. The core of the issue lies in the plugin's inability to verify whether the user initiating a request possesses the necessary authorization rights before executing state-changing operations. Furthermore, the implementation fails to validate or restrict the specific names of options that can be targeted for deletion, creating an unrestricted vector for arbitrary configuration modification and destruction.
From a technical perspective, this vulnerability is classified under CWE-284 Improper Access Control and CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes. The absence of authorization checks means the application does not enforce any security context on incoming requests directed at specific endpoints or AJAX handlers associated with the plugin's functionality. By exploiting this lack of validation, an attacker can supply arbitrary option names as parameters in their request payload. Since WordPress options store critical site configuration data, including authentication keys, active plugins lists, and theme settings, the ability to delete these entries arbitrarily leads directly to a denial of service condition for the website itself.
The operational impact of this vulnerability is severe, effectively allowing an unauthenticated user to take complete control over the integrity and availability of the targeted WordPress site. By deleting specific options, attackers can deactivate all installed instances of the Zip Money Payments Plugin, disrupting payment processing capabilities. More critically, they can remove essential security configurations such as authentication salts or active plugin lists that prevent unauthorized access. This destruction of configuration data results in a complete loss of service, where legitimate users are unable to interact with the site due to broken functionality and potential exposure of sensitive backend processes. The attacker does not need valid credentials, making this vulnerability particularly dangerous in public-facing environments where such endpoints may be indexed or discoverable through automated scanning tools.
This behavior aligns with ATT&CK technique T1485 Destruction, which involves data destruction on local systems to impact availability and integrity. In the context of web applications, it also reflects aspects of T1078 Valid Accounts if combined with other vulnerabilities, but in this specific case, the lack of authentication makes it a pure exploitation of broken access control leading to service disruption. The ability to delete arbitrary options means that even non-plugin related configurations can be targeted, potentially breaking themes, widgets, or core WordPress settings required for basic site operation.
Mitigation strategies must focus on immediate patching and defensive coding practices. Administrators running affected versions should upgrade the Zip Money Payments Plugin for WooCommerce to version 2.4.0 or later as soon as possible, as this release addresses the authorization gaps in the request handlers. In environments where upgrading is not immediately feasible, implementing a Web Application Firewall (WAF) rule to block requests containing suspicious option deletion patterns can provide temporary protection. Developers should ensure that all front-end endpoints performing state-changing operations implement strict capability checks using WordPress functions such as current_user_can or similar role-based access control mechanisms. Additionally, input validation must be enforced to whitelist allowed option names rather than relying on the assumption that user-supplied data is safe for direct database manipulation. Regular security audits and code reviews focusing on authorization logic are essential to prevent similar vulnerabilities in future updates.