This vulnerability (CVE-2026-34891) in IDPay Payment Gateway for Woocommerce versions <= 2.2.5 allows unauthenticated attackers to access sensitive system information without authorization. The issue falls under CWE-497, which involves exposure of sensitive information to unauthorized entities. The CVSS 3.1 base score is 7.5, reflecting a high severity due to network attack vector, no required privileges, and no user interaction needed, with a high impact on confidentiality. There is no vendor advisory or patch available at this time, and the product is not a cloud service, so remediation depends on vendor action or user mitigation.

An attacker can remotely access sensitive system information without authentication, potentially leading to information disclosure that could aid further attacks. The confidentiality impact is high, but integrity and availability are not affected. This exposure could compromise sensitive data handled by the payment gateway plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary workaround is currently available, users should monitor vendor communications for updates. Until a patch is released, consider restricting access to the affected plugin or disabling it if feasible to reduce exposure.