# MONEI Payments for WooCommerce <= 7.3.5 - Authenticated (Subscriber+) Missing Authorization to Payment Token Attachment via Payment Method Redirect

- **ID:** WPSEC-2026-1440
- **Plugin:** MONEI Payments for WooCommerce (`monei`), https://wordpress.org/plugins/monei/
- **Affected versions:** all versions before 7.3.6
- **Fixed in:** 7.3.6 (Update to 7.3.6 or later.)
- **Severity:** Medium 4.2 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-22)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/monei
- **Fix released:** 2026-10-21
- **Published:** 2026-10-22
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1440/

## Description

The MONEI Payments for WooCommerce plugin for WordPress is vulnerable to Missing Authorization via the add-payment-method and order-received redirect handlers in all versions up to, and including, 7.3.5, due to a missing check that the MONEI payment named in the 'id' query parameter was started by the current user or belongs to the order. This makes it possible for authenticated attackers, with Subscriber-level access and above, who know another customer's MONEI payment ID to save that payment's card token to their own account, where it could be used for purchases.

## References

- https://wpsec.com/vuln/WPSEC-2026-1440/
- https://plugins.svn.wordpress.org/monei/tags/7.3.6/
- https://wordpress.org/plugins/monei/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1440/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.