CVE-2026-4663 - Vulnerability Details

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-39608. Reason: This candidate is a reservation duplicate of CVE-2026-39608. Notes: All CVE users should reference CVE-2026-39608 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Ipospays	Ipospays Gateways Wc
Wordpress	Wordpress

No data.

References

No reference.

History

Mon, 18 May 2026 16:30:00 +0000

Type	Values Removed	Values Added
Title	iPOSpays Gateways WC <= 1.3.7 - Unauthenticated Missing Authorization to Settings Update via REST API Endpoint
Weaknesses	CWE-862
References	https://plugins.trac.wordpress.org/browser/ipospays-gateways-wc/tags/1.3.7/includes/payment-methods/class-ftd-redirect-gateway.php#L253 https://plugins.trac.wordpress.org/browser/ipospays-gateways-wc/tags/1.3.7/includes/payment-methods/class-ftd-redirect-gateway.php#L336 https://plugins.trac.wordpress.org/browser/ipospays-gateways-wc/tags/1.3.7/includes/payment-methods/class-ftd-redirect-gateway.php#L381 https://plugins.trac.wordpress.org/browser/ipospays-gateways-wc/trunk/includes/payment-methods/class-ftd-redirect-gateway.php#L253 https://plugins.trac.wordpress.org/browser/ipospays-gateways-wc/trunk/includes/payment-methods/class-ftd-redirect-gateway.php#L336 https://plugins.trac.wordpress.org/browser/ipospays-gateways-wc/trunk/includes/payment-methods/class-ftd-redirect-gateway.php#L381 https://www.wordfence.com/threat-intel/vulnerabilities/id/a1a30930-31c1-4254-867c-073932672a39?source=cve
Metrics	cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'}` ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mon, 18 May 2026 15:30:00 +0000

Type	Values Removed	Values Added
Description	The iPOSpays Gateways WC plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 1.3.7. This is due to the plugin exposing a REST API endpoint /wp-json/ipospays/v1/save_settings with 'permission_callback' set to '__return_true', which allows unauthenticated access without any capability checks or nonce verification. This makes it possible for unauthenticated attackers to update plugin settings, specifically allowing them to overwrite critical payment gateway settings including live API keys, secret keys, and payment tokens stored in the 'woocommerce_ipospays_settings' option.	REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-39608. Reason: This candidate is a reservation duplicate of CVE-2026-39608. Notes: All CVE users should reference CVE-2026-39608 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.

Tue, 12 May 2026 22:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Tue, 12 May 2026 12:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Ipospays Ipospays ipospays Gateways Wc Wordpress Wordpress wordpress
Vendors & Products		Ipospays Ipospays ipospays Gateways Wc Wordpress Wordpress wordpress

Tue, 12 May 2026 08:30:00 +0000

Type	Values Removed	Values Added
Description		The iPOSpays Gateways WC plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 1.3.7. This is due to the plugin exposing a REST API endpoint /wp-json/ipospays/v1/save_settings with 'permission_callback' set to '__return_true', which allows unauthenticated access without any capability checks or nonce verification. This makes it possible for unauthenticated attackers to update plugin settings, specifically allowing them to overwrite critical payment gateway settings including live API keys, secret keys, and payment tokens stored in the 'woocommerce_ipospays_settings' option.
Title		iPOSpays Gateways WC <= 1.3.7 - Unauthenticated Missing Authorization to Settings Update via REST API Endpoint
Weaknesses		CWE-862
References		https://plugins.trac.wordpress.org/browser/ipospays-gateways-wc/tags/1.3.7/includes/payment-methods/class-ftd-redirect-gateway.php#L253 https://plugins.trac.wordpress.org/browser/ipospays-gateways-wc/tags/1.3.7/includes/payment-methods/class-ftd-redirect-gateway.php#L336 https://plugins.trac.wordpress.org/browser/ipospays-gateways-wc/tags/1.3.7/includes/payment-methods/class-ftd-redirect-gateway.php#L381 https://plugins.trac.wordpress.org/browser/ipospays-gateways-wc/trunk/includes/payment-methods/class-ftd-redirect-gateway.php#L253 https://plugins.trac.wordpress.org/browser/ipospays-gateways-wc/trunk/includes/payment-methods/class-ftd-redirect-gateway.php#L336 https://plugins.trac.wordpress.org/browser/ipospays-gateways-wc/trunk/includes/payment-methods/class-ftd-redirect-gateway.php#L381 https://www.wordfence.com/threat-intel/vulnerabilities/id/a1a30930-31c1-4254-867c-073932672a39?source=cve
Metrics		cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'}`