Vulnerabilities

The MIPL Grouped Checkout Fields for WooCommerce – Customize & Organize Checkout Fields plugin for WordPress is affected by an unrestricted file-upload flaw (CWE-434): the mipl_wc_upload_file function performs no file-type validation in all versions up to and including 1.2.1. An unauthenticated, remote attacker can trigger the flaw by submitting a crafted upload request over the network, with no authentication or user interaction required (CVSS 9.8, vector AV:N/AC:L/PR:N/UI:N). By uploading arbitrary files — for example a PHP script — to a web-executable location, the attacker may achieve remote code execution and compromise the site, matching the high confidentiality, integrity, and availability impact reflected in the critical 9.8 score. Any WordPress site, typically a WooCommerce store, running the plugin at version 1.2.1 or older is affected. As of the available data there is no public proof-of-concept, the issue is not listed in CISA's Known Exploited Vulnerabilities catalog, and no in-the-wild exploitation has been reported.

Do: Update the plugin to the first available release newer than 1.2.1 once a patched version is published (no fixed version number is stated in the available data), or deactivate the plugin until a fix ships. As an interim mitigation, deny PHP execution in the upload destination used by the plugin (typically under wp-content/uploads) via web-server rules so uploaded files cannot run. Because the flaw is exploitable by unauthenticated users on internet-facing stores, check the uploads directory for unexpected PHP or other unfamiliar files and review web-server logs for unauthenticated POST requests to the plugin's upload endpoint.

CVE-2026-78361 is a critical missing-authorization flaw (CWE-862) in the zipMoney (Zip Co) Payments Plugin for WooCommerce, a WordPress payment gateway plugin. The plugin's front-end request handler performs no authorization checks and does not restrict which option name a caller may supply, so any unauthenticated visitor can send a crafted request that deletes an arbitrary WordPress option. By targeting key options such as the site URL or the list of active plugins, an attacker can destroy site and access-control configuration, deactivate every installed plugin, and take the site offline; the impact is limited to integrity and availability, with no confidentiality loss. Only WordPress sites running the plugin in a version prior to 2.4.0 are affected. No public proof-of-concept or in-the-wild exploitation is currently known, and the issue is not listed in CISA's KEV.

Do: Update the plugin to version 2.4.0 or later. As an interim measure, block unauthenticated requests reaching the plugin's front-end handler (for example with WAF rules on the relevant action and option-name parameters) and confirm that critical options such as the site URL, home URL, and active-plugins list have not been deleted. Operators who notice unexpected site downtime or mass plugin deactivation should check for evidence of this option-deletion request pattern.