Sipay WooCommerce Virtual POS Module: Authentication Bypass and API Manipulation (CVE-2026-85632)
The Sipay WooCommerce Virtual POS Module is susceptible to missing authentication and integrity check validation vulnerabilities allowing authentication bypass and application API message manipulation via Man-in-the-Middle.
CVE search metadata
CVE search record: CVE-2026-85632. Severity: critical. CVSS: 9.1. KEV: no. Product: WooCommerce Virtual POS Module (< 26.9.1). Brief: Sipay WooCommerce Virtual POS Module: Authentication Bypass and API Manipulation (CVE-2026-85632). Brief link: https://feed.craftedsignal.io/briefs/2026-11-sipay-woocommerce-auth-bypass-cve-2026-85632/
Triage facts
Revision 1- Applicability
- WooCommerce Virtual POS Module (< 26.9.1)
- Evidence
- Unknown
- Severity
- Critical
- Sources
- 1 public source
- Freshness
- Revision 1Nov 11, 16:06 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
The Sipay Electronic Money and Payment Services Inc. WooCommerce Virtual POS Module is vulnerable to missing authentication for critical functions and improper validation of integrity check values (CVE-2026-85632). These flaws allow an attacker positioned to perform a Man-in-the-Middle (MitM) attack to achieve authentication bypass and application API message manipulation. This issue affects WooCommerce Virtual POS Module: from 26.8.3 before 26.9.1.
Impact
The vulnerability is rated with a CVSS v3.1 base score of 9.1.
Recommendation
Update the Sipay WooCommerce Virtual POS Module to version 26.9.1 or later.