CVE-2026-39608: 
WordPress vulnerability analysis and mitigation

CVE-2026-39608 is a Missing Authorization (Broken Access Control) vulnerability in the iPOSpays Gateways WC WordPress plugin, affecting versions up to and including 1.3.7. It allows unauthenticated remote attackers to exploit incorrectly configured access control security levels, potentially performing unauthorized privileged actions. The vulnerability was reported by researcher Legion Hunter on January 8, 2026, and published by Patchstack on February 7, 2026. It carries a CVSS v3.1 base score of 5.3 (Medium), assessed by CISA-ADP (Patchstack).

The root cause is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly verify whether a requesting user has the necessary permissions before executing certain privileged functions. This is a network-accessible vulnerability requiring no authentication, no user interaction, and low attack complexity, making it trivially exploitable by any remote attacker. The flaw falls under the OWASP Top 10 category A1: Broken Access Control, and is characteristic of WordPress plugins that omit capability checks or nonce validation on sensitive AJAX handlers or REST API endpoints (Patchstack).

Successful exploitation allows an unauthenticated attacker to perform unauthorized actions that should be restricted to higher-privileged users, resulting in a low integrity impact with no confidentiality or availability impact according to the CVSS assessment. In the context of a WooCommerce payment gateway plugin, unauthorized manipulation of gateway settings or payment configurations could potentially disrupt transactions or redirect payment flows. Patchstack notes the severity impact is low and exploitation is unlikely to be highly impactful in practice (Patchstack).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack classifies this as low priority, noting it is unlikely to be exploited, though vulnerabilities of this class are sometimes used in mass-exploit campaigns targeting WordPress sites at scale (Patchstack).

The vendor has released version 1.3.8 of the iPOSpays Gateways WC plugin, which patches this vulnerability. Site administrators should update the plugin to version 1.3.8 or later immediately via the WordPress admin dashboard. If an immediate update is not possible, consult your hosting provider or web developer for assistance. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard (Patchstack).