Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.1

zipMoney Payments Plugin for WooCommerce can delete site settings

CVE-2026-78361 · published 1 month ago
Summary

The zipMoney Payments plugin for WooCommerce versions before 2.4.0 lets anyone on the internet send a request that removes stored settings in WordPress. This could erase important configuration, turn off the plugin, and potentially take the website offline. Update the plugin to version 2.4.0 or later, or remove it if you are not using it, to stop the risk.

What to do
  • Update unknown zipmoney(zip co) payments plugin for woocommerce to version 2.4.0 or later.
Affected software
VendorProductAffected versions
unknown zipmoney(zip co) payments plugin for woocommerce < 2.4.0
Original advisory text
zipMoney(Zip Co) Payments Plugin for WooCommerce < 2.4.0 - Unauthenticated Arbitrary Option Deletion
The zipMoney(Zip Co) Payments Plugin for WooCommerce WordPress plugin before 2.4.0 does not perform any authorisation checks on one of its front-end request handlers, and does not restrict which option name a caller may supply, allowing unauthenticated users to delete arbitrary WordPress options. This can be used to destroy site and access control configuration, deactivate every installed zipMoney(Zip Co) Payments Plugin for WooCommerce WordPress plugin before 2.4.0, and take the site offline.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
9.1 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-862Missing Authorization
Timeline
Published10 Sep 2026
Updated11 Oct 2026
First seen10 Sep 2026
Sources
CVE-2026-78361 · NVD
CVE-2026-78361 · MITRE
Track software like this
Free during beta