CVE-2026-34891

Vulnerability

The IDPay Payment Gateway for WooCommerce plugin for WordPress (version 2.2.5 and earlier) suffers from an unauthenticated sensitive data exposure vulnerability [1]. The flaw allows any unauthenticated user to access sensitive information that is normally restricted, without requiring any special configuration or conditions [1].

Exploitation

An attacker can exploit this vulnerability from the network without needing any authentication or user interaction [1]. The exact attack vector and the path exposed are not detailed in the available references, but the vulnerability is described as being used in mass-exploit campaigns targeting thousands of websites [1].

Impact

Successful exploitation enables a malicious actor to view sensitive information that is normally not available to regular users [1]. This could include payment-related data or other plugin internals, potentially allowing the attacker to further compromise the system [1].

Mitigation

The immediate action is to update the affected plugin to a version newer than 2.2.5 [1]. Users unable to update should seek help from their hosting provider or web developer [1]. No workaround or patched version number is disclosed in the available reference beyond the recommendation to update [1].