MONEI Payments for WooCommerce <= 7.3.5 - Unauthenticated Insecure Direct Object Reference to Subscription Payment Data Update
- ID
- WPSEC-2026-1439
- Plugin
- MONEI Payments for WooCommerce (monei)
- Affected
- all versions before 7.3.6
- Remediation
- Update to 7.3.6 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-639
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-22
- Attack surface
- MONEI Payments for WooCommerce on WPSec AttackSurface
- Fix released
- Published
Description
The MONEI Payments for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference via the subscription order-received and payment-method-change redirect handlers in all versions up to, and including, 7.3.5, due to the subscriptions_save_sequence_id() and subscriptions_save_sequence_id_on_payment_method_change() functions using an order ID from the request without checking the order key or the subscription owner, and without checking that the fetched MONEI payment belongs to that order. This makes it possible for unauthenticated attackers to overwrite the stored MONEI payment data (sequence ID and card details used for renewals) of other customers' subscriptions, when WooCommerce Subscriptions or YITH WooCommerce Subscription is active.
References
- https://wpsec.com/vuln/WPSEC-2026-1439/
- https://plugins.svn.wordpress.org/monei/tags/7.3.6/
- https://wordpress.org/plugins/monei/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS