CVE-2026-86791: CWE-345 Insufficient Verification of Data Authenticity in iPOSpays Payment Gateway for WooCommerce

CVE-2026-86791 affects the iPOSpays Payment Gateway for WooCommerce WordPress plugin prior to version 1.4.7. The plugin fails to verify that a payment transaction was actually completed before recording an order as paid. This flaw enables unauthenticated attackers to mark any unpaid order as paid and modify the order total, potentially leading to incorrect order processing and financial discrepancies. The vulnerability is categorized under CWE-345, indicating insufficient verification of data authenticity.

An attacker without authentication can mark unpaid orders as paid and rewrite the total amount of the order. This could lead to financial inconsistencies and potential fraud in order processing. There is no indication of confidentiality or availability impact. The vulnerability has a medium severity rating with a CVSS 3.1 base score of 5.3.

A fixed version 1.4.7 or later is implied but no explicit patch link is provided. Users should upgrade to version 1.4.7 or later to remediate this vulnerability. Until then, restrict access to the payment gateway plugin and monitor for unauthorized order modifications. Patch status is not explicitly confirmed in the input data; check the vendor advisory for current remediation guidance.