# MONEI Payments for WooCommerce <= 7.3.5 - Unauthenticated Insecure Direct Object Reference to Subscription Payment Data Update

- **ID:** WPSEC-2026-1439
- **Plugin:** MONEI Payments for WooCommerce (`monei`), https://wordpress.org/plugins/monei/
- **Affected versions:** all versions before 7.3.6
- **Fixed in:** 7.3.6 (Update to 7.3.6 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-639
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-22)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/monei
- **Fix released:** 2026-10-21
- **Published:** 2026-10-22
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1439/

## Description

The MONEI Payments for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference via the subscription order-received and payment-method-change redirect handlers in all versions up to, and including, 7.3.5, due to the subscriptions_save_sequence_id() and subscriptions_save_sequence_id_on_payment_method_change() functions using an order ID from the request without checking the order key or the subscription owner, and without checking that the fetched MONEI payment belongs to that order. This makes it possible for unauthenticated attackers to overwrite the stored MONEI payment data (sequence ID and card details used for renewals) of other customers' subscriptions, when WooCommerce Subscriptions or YITH WooCommerce Subscription is active.

## References

- https://wpsec.com/vuln/WPSEC-2026-1439/
- https://plugins.svn.wordpress.org/monei/tags/7.3.6/
- https://wordpress.org/plugins/monei/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1439/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.