CVE-2026-34891: IDPay WooCommerce Unauthenticated Data Exposure – HIGH Severity

Technical summary

CVE-2026-34891 is an unauthenticated sensitive data exposure vulnerability (CWE-497: Exposure of Sensitive Information to an Unauthorized Actor) affecting IDPay Payment Gateway for WooCommerce up to version 2.2.5. The vulnerability has a CVSS 3.1 score of 7.5 (HIGH) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, indicating network-accessible attack surface, no authentication or user interaction required, and confidentiality impact as the primary concern. The flaw permits unauthorized retrieval of sensitive payment transaction data through unauthenticated network requests.

Business impact

Organizations running affected versions of the IDPay WooCommerce plugin face direct exposure of customer payment data, transaction histories, and potentially personally identifiable information. This creates regulatory compliance violations under PCI DSS, GDPR, and similar data protection frameworks, with corresponding financial penalties, mandatory breach notifications, and reputational damage. Customer trust erosion and potential legal liability from inadequate data protection controls compound the business risk.

Affected systems

The vulnerability affects IDPay Payment Gateway for WooCommerce in versions 2.2.5 and earlier. This plugin is used by WooCommerce merchants to process payments through the IDPay gateway. Any WordPress site running WooCommerce with the affected IDPay plugin version is at risk. Organizations should audit their WooCommerce installations to identify current plugin versions and deployment scope.

Exploitability

This vulnerability requires only network access and no authentication, making it highly exploitable. An attacker can access sensitive data without logging in, solving puzzles, or user interaction. The straightforward attack surface—combined with the likelihood that many small-to-medium e-commerce operators may not promptly patch—suggests exploitation risk is moderate to high in the wild. However, the vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, indicating no confirmed active exploitation has been publicly documented as of the publication date.

Remediation

Immediately upgrade the IDPay Payment Gateway for WooCommerce plugin to a version later than 2.2.5. Verify against the vendor's official advisory to confirm the exact patched version. After patching, review access logs for indicators of unauthorized data access prior to remediation. Consider implementing Web Application Firewall (WAF) rules to restrict suspicious data exfiltration patterns while patches are being deployed. Conduct a post-incident review to ensure payment data was not compromised.

Patch guidance

Apply the latest version of IDPay Payment Gateway for WooCommerce available from the official plugin repository or vendor. Verify the patched version number against the official IDPay or WooCommerce plugin advisory to ensure the security issue is addressed. Test the patched version in a staging environment before production deployment to confirm compatibility with your WooCommerce configuration. Schedule the update during a maintenance window to minimize customer impact. After upgrade, confirm the plugin version change in your WooCommerce administration panel.

Detection guidance

Monitor WooCommerce plugin version inventories to identify any installations running version 2.2.5 or earlier. Search web server logs and WordPress database logs for unauthorized API calls or data access requests to the IDPay payment gateway endpoint—particularly requests that retrieve transaction or payment data without valid authentication tokens. Implement application-level logging to track data access patterns. Use vulnerability scanning tools to detect the vulnerable plugin version across your infrastructure. Review access logs for anomalous patterns originating from external IP addresses targeting payment processing endpoints.

Why prioritize this

This vulnerability merits immediate priority because it enables unauthenticated access to sensitive payment data with no attack complexity, directly violating data protection regulations and creating customer liability exposure. While not yet in the CISA KEV catalog, the low barrier to exploitation and high-value target (payment information) make it an attractive target for opportunistic attackers. Organizations handling PCI-regulated data must treat this as urgent.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) reflects the combination of: (1) network-accessible attack vector requiring no authentication or user interaction, (2) high confidentiality impact (sensitive payment and transaction data exposure), and (3) no integrity or availability impact. The score appropriately captures the serious but non-critical nature of this data exfiltration flaw. Organizations processing payment data should treat this as a P1 issue regardless of CVSS score due to regulatory and customer trust implications.

Frequently asked questions