CVE-2026-85632

CVSS 9.1 (critical) · published 2026-11-11

Missing authentication for critical function and Improper validation of integrity check value vulnerability in Sipay Electronic Money and Payment Services Inc. WooCommerce Virtual POS Module allows Authentication Bypass and Application API Message Manipulation via Man-in-the-Middle. This issue affects WooCommerce Virtual POS Module: from 26.8.3 before 26.9.1.

Weakness: CWE-306, CWE-354

Source: NVD CVE-2026-85632

References

• https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1520

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.