Vulnerabilities / MONEI Payments for WooCommerce / WPSEC-2026-1440
MONEI Payments for WooCommerce <= 7.3.5 - Authenticated (Subscriber+) Missing Authorization to Payment Token Attachment via Payment Method Redirect
Medium 4.2
CWE-862Fixed in 7.3.6
- ID
- WPSEC-2026-1440
- Plugin
- MONEI Payments for WooCommerce (monei)
- Affected
- all versions before 7.3.6
- Remediation
- Update to 7.3.6 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-22
- Attack surface
- MONEI Payments for WooCommerce on WPSec AttackSurface
- Fix released
- Published
Description
The MONEI Payments for WooCommerce plugin for WordPress is vulnerable to Missing Authorization via the add-payment-method and order-received redirect handlers in all versions up to, and including, 7.3.5, due to a missing check that the MONEI payment named in the 'id' query parameter was started by the current user or belongs to the order. This makes it possible for authenticated attackers, with Subscriber-level access and above, who know another customer's MONEI payment ID to save that payment's card token to their own account, where it could be used for purchases.
References
- https://wpsec.com/vuln/WPSEC-2026-1440/
- https://plugins.svn.wordpress.org/monei/tags/7.3.6/
- https://wordpress.org/plugins/monei/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS