Cpe:2.3:a:sipay_electronic_money_and_payment_services:woocommerce_virtual_pos_module:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3asipay_electronic_money_and_payment_serviceswoocommerce_virtual_pos_module/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 11 Nov 2026 16:06:35 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgSipay WooCommerce Virtual POS Module: Authentication Bypass and API Manipulation (CVE-2026-85632)https://feed.craftedsignal.io/briefs/2026-11-sipay-woocommerce-auth-bypass-cve-2026-85632/Wed, 11 Nov 2026 16:06:35 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-sipay-woocommerce-auth-bypass-cve-2026-85632/The Sipay WooCommerce Virtual POS Module is susceptible to missing authentication and integrity check validation vulnerabilities allowing authentication bypass and application API message manipulation via Man-in-the-Middle.The Sipay Electronic Money and Payment Services Inc. WooCommerce Virtual POS Module is vulnerable to missing authentication for critical functions and improper validation of integrity check values (CVE-2026-85632). These flaws allow an attacker positioned to perform a Man-in-the-Middle (MitM) attack to achieve authentication bypass and application API message manipulation. This issue affects WooCommerce Virtual POS Module: from 26.8.3 before 26.9.1.

Impact

The vulnerability is rated with a CVSS v3.1 base score of 9.1.

Recommendation

Update the Sipay WooCommerce Virtual POS Module to version 26.9.1 or later.

]]>criticaladvisory