7.2High

CVE-2026-116869WordPress myPOS Checkout plugin <= 1.4.5 - PHP Object Injection vulnerability

myPOS Payments myPOS Checkout Published: 2026-10-29 18:24 (5 days ago)

Description

Shop manager PHP Object Injection in myPOS Checkout <= 1.4.5 versions.

Weakness (CWE): CWE-502

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

Vendor	Product	Versions
myPOS Payments	myPOS Checkout	≤ 1.4.5

References and patches

https://patchstack.com/database/wordpress/plugin/mypos-virtual-for-woocommerce/vulnerability/wordpress-mypos-… vdb-entry

CVSS score

7.2High

Source: Patchstack · CVSS 3.1

Attack vector: Network
Attack complexity: Low
Privileges required: High
User interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

All scores (2)

cna	CVSS 3.1	7.2High
audit@patchstack.com	CVSS 3.1	7.2High

EPSS (chance of exploitation in 30 days)

0.30%

higher than 23% of all CVEs

CISA assessment (SSVC)

Exploitation: none
Automatable: no
Technical impact: total

Timeline

ID reserved2026-10-27
Published2026-10-29 18:24
Reached IP-DB2026-10-29 19:03
Last updated2026-10-30 22:18

Assigned by (CNA): Patchstack
NVD status: Deferred

View at source: CVE.org · NVD

Get told when these products get a new vulnerability

Turn on email alerts

Free · with an account · switch off any time

Recent CVEs in the same product — WordPress plugins & themes

8.8High

CVE-2026-76124 3 hours ago

BuddyBoss App <= 3.2.1 - Authenticated (Subscriber+) Arbitrary File Upload via Feedback Endpoint

BuddyBoss BuddyBoss App

The BuddyBoss App plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.2.1 via the send_feedback function. This is due to insufficient file type validation that relies solely on the client-supplied Content-Type h…

5.3Medium

CVE-2026-91075 7 hours ago

Eupago Gateway For Woocommerce 4.5.0 - 4.7.5 - Unauthenticated Payment Confirmation Bypass

Eupago Gateway For Woocommerce

The Eupago Gateway For Woocommerce WordPress plugin from 4.5.0 through 4.7.5 does not verify the authenticity of incoming payment-confirmation webhook requests in some configurations, allowing unauthenticated attackers to forge a payment confirmation and mark…

5.3Medium

CVE-2026-103327 7 hours ago

CryptoCloud - Crypto Payment Gateway 3.0.0 - 3.0.1 - Unauthenticated Arbitrary Order Payment Forgery via Empty-Default Webhook Secret

CryptoCloud

The CryptoCloud WordPress plugin from 3.0.0 through 3.0.1 does not verify the authenticity of the payment notifications received by its gateway callback, as the integrity check is skipped while the webhook secret is left at its empty default, allowing unauthe…

Unscored

CVE-2026-103379 9 hours ago

WATI Chat and Notification <= 1.1.8 - Unauthenticated Customer Order PII Disclosure via Leaked API Token

WATI Chat and Notification

The WATI Chat and Notification WordPress plugin through 1.1.8 does not require a valid, non-empty secret on a public endpoint that returns its stored API token, which an unauthenticated attacker can then present to a second public endpoint to obtain the order…

Unscored

CVE-2026-104647 9 hours ago

weMail <= 2.1.6 - Editor+ Incorrect Authorization via User::can()

weMail

The weMail WordPress plugin through 2.1.6 does not correctly verify user capabilities in its REST API permission checks, treating any user whose role is in the weMail WordPress plugin through 2.1.6's allowed-roles list (Editor and above by default) as autho…

Unscored

CVE-2026-104648 9 hours ago

weMail <= 2.1.6 - Editor+ API Key Disclosure

weMail

The weMail WordPress plugin through 2.1.6 does not restrict a site-wide third-party email-service API key to administrators, exposing it in an admin screen that users with the Editor role can reach by default, which allows them to obtain a reusable credentia…