CVE-2026-85632 is a critical (CVSS 9.1) flaw in Sipay's WooCommerce Virtual POS Module that allows authentication bypass and manipulation of application API messages through a man-in-the-middle position.
What Is It
CVE-2026-85632 combines two weaknesses in the WooCommerce Virtual POS Module from Sipay Electronic Money and Payment Services Inc.:
- CWE-306: Missing Authentication for Critical Function. A critical function can be reached without authentication.
- CWE-354: Improper Validation of Integrity Check Value. The module does not properly validate integrity checks.
According to the NVD description, these weaknesses allow Authentication Bypass and Application API Message Manipulation via Man-in-the-Middle. USOM ([email protected]), Türkiye's national CERT, assigned the CVE. The record was published on 2026-11-11, and its NVD status is currently "Received."
Why It Matters
USOM rates the issue 9.1 CRITICAL under CVSS v3.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N):
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Confidentiality / Integrity Impact: High / High
- Availability Impact: None
The affected product is a payment module for WooCommerce storefronts. A flaw that lets an attacker bypass authentication and alter API messages could undermine the trust between a merchant site and its payment flow. The high confidentiality and integrity scores reflect that risk.
Exploitation status: This CVE has no entry in the CISA Known Exploited Vulnerabilities (KEV) catalog, so KEV does not confirm active exploitation at this time.
What's Vulnerable
- Vendor: Sipay Electronic Money and Payment Services Inc.
- Product: WooCommerce Virtual POS Module
- Affected versions: 26.8.3 up to, but not including, 26.9.1 (semver)
- Default status for other versions: Unaffected
The NVD record does not list any CPEs yet.
Patch Status
The affected range ends before version 26.9.1, so 26.9.1 and later fall outside it. Merchants running versions 26.8.3 through 26.9.0 should move to 26.9.1 or later and check the USOM advisory for vendor guidance.
CISA has not set a required action or due date because the CVE is not in the KEV catalog.
Sources
- NVD: CVE-2026-85632
- USOM Security Notification TR-26-1520
- CISA Known Exploited Vulnerabilities Catalog (no entry for this CVE)