Vulnerabilities / Ni WooCommerce Payment Gateway Charges / WPSEC-2026-0416
Ni WooCommerce Payment Gateway Charges < 1.7.0 - Missing Authorization to Unauthenticated Settings Update
Medium 5.3
CWE-862Fixed in 1.7.0
- ID
- WPSEC-2026-0416
- Plugin
- Ni WooCommerce Payment Gateway Charges (ni-woocommerce-payment-gateway-charges)
- Affected
- all versions before 1.7.0
- Remediation
- Update to 1.7.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-22
- Attack surface
- Ni WooCommerce Payment Gateway Charges on WPSec AttackSurface
- Fix released
- Published
Description
The Ni WooCommerce Payment Gateway Charges plugin for WordPress is vulnerable to unauthorized modification of data in all versions prior to 1.7.0 due to a missing capability check and missing nonce verification on the admin_init_save function, which runs on the admin_init hook. This makes it possible for unauthenticated attackers to overwrite the plugin's settings option, for example enabling or disabling the extra payment gateway charges added at checkout and changing whether they are calculated with tax.
References
- https://wpsec.com/vuln/WPSEC-2026-0416/
- https://plugins.svn.wordpress.org/ni-woocommerce-payment-gateway-charges/tags/1.7.0/
- https://wordpress.org/plugins/ni-woocommerce-payment-gateway-charges/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS