CVE-2026-85632

Name of the Vulnerable Software and Affected Versions Sipay Electronic Money and Payment Services Inc. WooCommerce Virtual POS Module versions 26.8.3 through 26.9.0

Description Missing authentication for a critical function and improper validation of the integrity check value allow for authentication bypass and application API message manipulation via a Man-in-the-Middle attack. This issue occurs during payment callback handling, enabling an attacker positioned between the user and the payment service to alter payment messages and read or modify data without authentication.

Recommendations Update Sipay Electronic Money and Payment Services Inc. WooCommerce Virtual POS Module to version 26.9.1.