This vulnerability (CVE-2026-34891) affects IDPay Payment Gateway for Woocommerce versions up to 2.2.5 and involves unauthenticated exposure of sensitive data. The weakness corresponds to CWE-497, meaning sensitive system information can be accessed by unauthorized parties without authentication. The CVSS v3.1 base score is 7.5, reflecting a high severity due to network attack vector, no privileges required, no user interaction, and high confidentiality impact. There is no known exploit in the wild and no vendor-provided patch or remediation level at this time.

An attacker can remotely access sensitive system information without authentication, potentially leading to information disclosure that could aid further attacks. The confidentiality impact is high, but integrity and availability are not affected. This exposure could compromise the security posture of systems using the affected plugin versions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider limiting exposure of the affected plugin or disabling it if feasible. Monitor vendor communications for updates on patches or mitigations.