CVE-2026-39608

MediumCVSS 5.3

Published: 08/04/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.21%

12th percentile - higher than 12% of all known CVEs

Summary

The iPOSpays Gateways WC plugin for WordPress has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This issue affects versions up to and including 1.3.7.

Risk Assessment

An attacker can manipulate payment gateways or transaction data, leading to financial losses and compromised payment security.

Recommendation

Update the iPOSpays Gateways WC plugin as soon as possible to a version that includes a security fix.

Original NVD description (English source)

Missing Authorization vulnerability in iPOSPays iPOSpays Gateways WC ipospays-gateways-wc allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects iPOSpays Gateways WC: from n/a through <= 1.3.7.