CVE-2026-78361— zipMoney(Zip Co) Payments Plugin for WooCommerce < 2.4.0 - Unauthenticated Arbitrary Option Deletion
Quick assessment
Affected
Unknown zipMoney(Zip Co) Payments Plugin for WooCommerce
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
WooCommerce 使用的 zipMoney（Zip Co）支付插件在 2.4.0 版本之前的版本中，其中一个前端请求处理程序未执行任何授权检查，且没有限制调用者可以提供的选项名称，这使得未认证用户能够删除任意 WordPress 选项。该漏洞可被利用以破坏网站和访问控制配置，停用已安装的 zipMoney（Zip Co）支付插件（2.4.0 之前的版本），并导致网站离线。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-78361
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
zipMoney(Zip Co) Payments Plugin for WooCommerce < 2.4.0 - Unauthenticated Arbitrary Option Deletion
Source: CVE Program / CVE List V5
Vulnerability Description
The zipMoney(Zip Co) Payments Plugin for WooCommerce WordPress plugin before 2.4.0 does not perform any authorisation checks on one of its front-end request handlers, and does not restrict which option name a caller may supply, allowing unauthenticated users to delete arbitrary WordPress options. This can be used to destroy site and access control configuration, deactivate every installed zipMoney(Zip Co) Payments Plugin for WooCommerce WordPress plugin before 2.4.0, and take the site offline.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | zipMoney(Zip Co) Payments Plugin for WooCommerce | 0 ~ 2.4.0 | - |
|
II. Public POCs for CVE-2026-78361
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-78361
请登录查看更多情报信息。
Security Blog Posts for CVE-2026-78361 (1)
-
🔗 zipMoney(Zip Co) Payments Plugin for WooCommerce < 2.4.0 – Unauthenticated Arbitrary Option Deletion | CVE 2026-78361 | Plugin Vulnerabilities Read full article exploit vdb-entry technical-description
Same Patch Batch · Unknown · 2026-09-10 · 8 CVEs total
| CVE-2026-82925 | Site Reviews 7.2.2 - 8.2.2 - Unauthenticated PHP Object Injection via Form Signature | |
| CVE-2026-81431 | Registration Form for WooCommerce 1.1.0 - 1.1.2 - Contributor+ Privilege Escalation via Un | |
| CVE-2026-77770 | miniOrange 2FA (Free & Pro) - Unauthenticated Arbitrary Option Deletion via Out-of-Band Em | |
| CVE-2026-77771 | miniOrange 2FA (Free & Pro) - 2FA Bypass via Session-Scoped OTP Lockout | |
| CVE-2026-19840 | Notiqoo < 1.4.14 - Contributor+ Arbitrary Option Update via Multiple AJAX Actions | |
| CVE-2026-19436 | Ultimate Gift Cards For WooCommerce < 3.2.10 - Unauthenticated Gift Card Value Inflation v | |
| CVE-2026-19439 | Ultimate Gift Cards for WooCommerce 3.0.3 - 3.2.9 - Unauthenticated Gift Card Code and Cus |
IV. Related Vulnerabilities
Same vendor: Unknown
-
CVE-2026-82925
Site Reviews 7.2.2 - 8.2.2 - Unauthenticated PHP Object Inje -
CVE-2026-81431
Registration Form for WooCommerce 1.1.0 - 1.1.2 - Contributo -
CVE-2026-77770
miniOrange 2FA (Free & Pro) - Unauthenticated Arbitrary Opti -
CVE-2026-77771
miniOrange 2FA (Free & Pro) - 2FA Bypass via Session-Scoped -
CVE-2026-19840
Notiqoo < 1.4.14 - Contributor+ Arbitrary Option Update via
V. Comments for CVE-2026-78361
No comments yet