Sipay WooCommerce Virtual POS Module Authentication Bypass Vulnerability

A vulnerability has been reported in Sipay Electronic Money and Payment Services Inc. WooCommerce Virtual POS Module. The issue is caused by missing authentication for a critical function and improper validation of integrity check values, resulting in Authentication Bypass and Application API Message Manipulation via Man-in-the-Middle.

An attacker positioned between the merchant and the payment service could bypass authentication and tamper with application API messages.

• Affected versions: from 26.8.3 before 26.9.1