{
 "id": "WPSEC-2026-1439",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1439/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1439/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1439/index.md",
 "title": "MONEI Payments for WooCommerce <= 7.3.5 - Unauthenticated Insecure Direct Object Reference to Subscription Payment Data Update",
 "description": "The MONEI Payments for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference via the subscription order-received and payment-method-change redirect handlers in all versions up to, and including, 7.3.5, due to the subscriptions_save_sequence_id() and subscriptions_save_sequence_id_on_payment_method_change() functions using an order ID from the request without checking the order key or the subscription owner, and without checking that the fetched MONEI payment belongs to that order. This makes it possible for unauthenticated attackers to overwrite the stored MONEI payment data (sequence ID and card details used for renewals) of other customers' subscriptions, when WooCommerce Subscriptions or YITH WooCommerce Subscription is active.",
 "plugin": {
  "slug": "monei",
  "name": "MONEI Payments for WooCommerce",
  "full_name": "MONEI Payments for WooCommerce",
  "wordpress_org": "https://wordpress.org/plugins/monei/",
  "advisories_url": "https://wpsec.com/vuln/plugin/monei/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/monei"
 },
 "type": "IDOR",
 "cwe": [
  "CWE-639"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "7.3.6",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 7.3.6"
  ]
 },
 "introduced_in": null,
 "fixed_in": "7.3.6",
 "remediation": "Update to 7.3.6 or later.",
 "fix_released": "2026-10-21T10:29:32+00:00",
 "published": "2026-10-22T10:48:20+00:00",
 "updated": "2026-10-21T12:22:55.779719+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1439/",
  "https://plugins.svn.wordpress.org/monei/tags/7.3.6/",
  "https://wordpress.org/plugins/monei/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/monei",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-22"
 }
}