External risk intelligence

WordPress ZipMoney Plugin Unauthenticated Option Deletion Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-78361

The vulnerability exists in a WordPress plugin designed for e-commerce payment processing. Such plugins are typically installed on public-facing web servers to facilitate customer transactions and are accessible to internet users.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in a popular e-commerce payment plugin for WordPress. This issue allows unauthorized users to disable critical site functions, potentially taking websites offline by deleting essential configuration options. The main concern is confirming relevance and exposure.

Unauthenticated users can disable site functions.
Affects e-commerce sites using a specific payment plugin.
Confirm if your sites use this plugin and assess exposure.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending a crafted request to a WordPress site that has a vulnerable version of the zipMoney Payments Plugin installed. Because the plugin lacks proper authorization checks, the attacker can trigger a function that deletes arbitrary WordPress options, potentially disabling critical site configurations or taking the entire site offline.

No authentication required.
Delete arbitrary site options.
Risk of site destruction and downtime.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow unauthenticated users to delete arbitrary WordPress options. When supported by the advisory, this could impact site configuration, access controls, and plugin functionality, potentially leading to a complete site outage.

WordPress site configuration data.
Unauthenticated deletion of site options.
Site inaccessibility and deactivation.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in a WordPress e-commerce plugin could allow unauthenticated users to delete site options, disable the plugin, and take the site offline. Real-world response likely involves application owners, platform teams, and security teams. The first step is to identify all instances of the affected plugin, confirm their exposure and criticality, and then plan remediation based on the risk of disruption.

Application owners should address this issue.
Verify plugin reachability and business criticality.
Plan remediation during the next maintenance window.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the zipMoney Payments Plugin for WooCommerce?

This is a WordPress plugin designed to integrate zipMoney payment processing services into e-commerce stores. It enables online shops to offer installment-based payment options to customers during checkout. Because it handles financial transactions, it must be installed on a web server accessible to customers, effectively connecting your WordPress site's backend functionality to the public internet.

What does CWE-862 mean for CVE-2026-78361?

CWE-862 refers to a 'Missing Authorization' weakness. In the context of this vulnerability, it means the plugin fails to verify the identity or permissions of a user before performing a sensitive task. Specifically, the plugin's front-end request handler accepts commands without checking if the requester is an authorized administrator, which allows anyone visiting the site to execute unauthorized actions.

How does an attacker trigger this vulnerability?

An attacker exploits this by sending a specially crafted web request directly to the plugin's front-end handler. This action does not require any login credentials or special user status to succeed. It is important to note that merely visiting the site as a regular customer does not trigger the bug; the attacker must intentionally send a specific, unauthorized request designed to target and delete WordPress configuration options.

Is my site relevant to this vulnerability?

According to Halo Surface Signal, this vulnerability is highly relevant if you use the affected plugin because it is designed for e-commerce, meaning it typically resides on a public-facing web server. Because the plugin is intentionally exposed to the internet to process customer payments, any site running vulnerable versions is directly reachable by unauthorized users who could attempt to delete critical configuration settings.

Do I need to take action if I use this plugin?

Yes, you should prioritize checking your site. First, verify if you are running a version of the plugin earlier than 2.4.0. If you are, consult the official plugin updates to secure your installation. Work with your team to assess the plugin's criticality to your site's operations and plan to apply the necessary update during your next maintenance window to prevent potential site downtime or unauthorized configuration changes.

References

wpscan.com/vulnerability/8b9a00f5-d7f5-447d-b109-d15e2cde3885/

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.