CVE-2026-78361

CVE-2026-78361 is a critical missing-authorization flaw (CWE-862) in the zipMoney (Zip Co) Payments Plugin for WooCommerce, a WordPress payment gateway plugin. The plugin's front-end request handler performs no authorization checks and does not restrict which option name a caller may supply, so any unauthenticated visitor can send a crafted request that deletes an arbitrary WordPress option. By targeting key options such as the site URL or the list of active plugins, an attacker can destroy site and access-control configuration, deactivate every installed plugin, and take the site offline; the impact is limited to integrity and availability, with no confidentiality loss. Only WordPress sites running the plugin in a version prior to 2.4.0 are affected. No public proof-of-concept or in-the-wild exploitation is currently known, and the issue is not listed in CISA's KEV.

What to do: Update the plugin to version 2.4.0 or later. As an interim measure, block unauthenticated requests reaching the plugin's front-end handler (for example with WAF rules on the relevant action and option-name parameters) and confirm that critical options such as the site URL, home URL, and active-plugins list have not been deleted. Operators who notice unexpected site downtime or mass plugin deactivation should check for evidence of this option-deletion request pattern.