Critical· 9.1official fix available
CVE-2026-78361
The zipMoney Payments Plugin for WooCommerce on WordPress has a critical flaw that lets anyone delete any WordPress option without logging in, potentially shutting down the site.
publishedSep 10, 2026
last modifiedSep 10, 2026
sourcesNVD
severity · cvss
9.1
critical · how bad it is
exploitation · epss
<1%
17th percentile · chance of exploitation in 30 days
(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →
auto-deletes from the system
counting…on Oct 10, 2026
An official fix is available, so this entry is kept for 30 days and then removed automatically.
01
Who is affected
WordPress sites using the zipMoney(Zip Co) Payments Plugin for WooCommerce before version 2.4.0.
02
Real-world impact
An attacker can delete site configuration options, deactivate the plugin, and bring the site offline, causing loss of functionality and availability.
03
Why this severity
The CVSS score of 9.1 reflects that the vulnerability requires no authentication, has low attack complexity, and can completely destroy site integrity and availability.
04
What to do about it
official fix available
recommended steps
- 01Upgrade the zipMoney Payments Plugin to version 2.4.0 or later.
NVD description indicates fix in version 2.4.0
05
Timeline
- Sep 10, 2026 · 4d agoPublishedDisclosed and added to the National Vulnerability Database.
- Sep 10, 2026 · 3d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
06
How it’s attacked
Attack vectorNetwork (remote)
Attack complexityLow
Privileges requiredNone
User interactionNone needed
ScopeUnchanged
Confidentiality impactNone
Integrity impactHigh
Availability impactHigh
07
References & advisories
(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →