{
 "id": "WPSEC-2026-1440",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1440/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1440/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1440/index.md",
 "title": "MONEI Payments for WooCommerce <= 7.3.5 - Authenticated (Subscriber+) Missing Authorization to Payment Token Attachment via Payment Method Redirect",
 "description": "The MONEI Payments for WooCommerce plugin for WordPress is vulnerable to Missing Authorization via the add-payment-method and order-received redirect handlers in all versions up to, and including, 7.3.5, due to a missing check that the MONEI payment named in the 'id' query parameter was started by the current user or belongs to the order. This makes it possible for authenticated attackers, with Subscriber-level access and above, who know another customer's MONEI payment ID to save that payment's card token to their own account, where it could be used for purchases.",
 "plugin": {
  "slug": "monei",
  "name": "MONEI Payments for WooCommerce",
  "full_name": "MONEI Payments for WooCommerce",
  "wordpress_org": "https://wordpress.org/plugins/monei/",
  "advisories_url": "https://wpsec.com/vuln/plugin/monei/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/monei"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.2,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "7.3.6",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 7.3.6"
  ]
 },
 "introduced_in": null,
 "fixed_in": "7.3.6",
 "remediation": "Update to 7.3.6 or later.",
 "fix_released": "2026-10-21T10:29:32+00:00",
 "published": "2026-10-22T10:48:20+00:00",
 "updated": "2026-10-21T12:22:55.779719+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1440/",
  "https://plugins.svn.wordpress.org/monei/tags/7.3.6/",
  "https://wordpress.org/plugins/monei/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/monei",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-22"
 }
}