zipMoney WooCommerce Plugin Flaw: Update Now

If your WooCommerce store runs the zipMoney (Zip Co) Payments Plugin older than version 2.4.0, update it to 2.4.0 or newer today, because a critical flaw lets anyone on the internet delete your site's settings without logging in.

This post is for owners of WooCommerce stores, and the agencies that look after them, who want to know if they are affected and what to do. You will get a plain-English explanation of the bug, a quick way to check your version, update steps (dashboard and command line), a way to spot damage, and a short list of what to do if you can't update right away.

What happened

The flaw is tracked as CVE-2026-78361. A CVE is a public ID number for a known security bug, so everyone can talk about the same problem. The National Vulnerability Database (NVD) entry was published on 2026-09-10 and lists it as Critical, with a CVSS score of 9.1 out of 10. CVSS is a standard 0 to 10 scale for how serious a bug is.

In short, the plugin has a request handler on the public side of your site that does not check who is calling it. It also does not limit which setting the caller can name. According to the NVD description, that lets an unauthenticated visitor (someone with no account at all) delete arbitrary WordPress options.

The NVD says this could be used to:

• destroy site and access control configuration,
• deactivate the plugin,
• and take the site offline.

The description says the problem exists in versions before 2.4.0, so 2.4.0 is the first version that should not be affected. The record does not list a separate affected-versions table, so we are going by that description. Check the plugin's changelog (the list of changes) to confirm the fix. The record also does not say whether anyone is actively exploiting the bug, and we are not claiming they are.

The record's NVD status is "Deferred". That means the NVD has not prioritized its own analysis of this entry. It does not mean the bug is minor or unconfirmed. The record's reference is a WPScan vulnerability entry.

What are WordPress "options" and why does deleting them hurt?

WordPress keeps its settings in a database table called options. Each row is one named setting. WordPress's developer documentation describes this system as the way core, themes and plugins save their settings.

Options hold things like:

• your site address,
• which plugins are switched on,
• who is allowed to register and what role new users get,
• and each plugin's own configuration.

Think of it as the control panel for the whole site. If a stranger can delete rows from it, they don't need your password to cause damage. Losing the list of active plugins can switch your store's features off. Losing other settings can break the site or change who can do what.

The CVSS vector in the record (AV:N/AC:L/PR:N/UI:N) says the same thing in code: reachable over the network, low complexity, no privileges, and no user interaction needed. The impact scores show no confidentiality loss (C:N) but high impact on integrity and availability (I:H/A:H). In plain words: the described problem is about breaking and changing things, not about reading customer data.

That said, a broken access-control setup is a bad place to be. If settings that govern who can do what get wiped, you should treat the site as needing a careful check afterward.

The root cause: missing authorization

The weakness type is CWE-862, Missing Authorization. The code did the action without first asking "is this person allowed to do this?"

This is a very common category. OWASP lists Broken Access Control as the number one web application risk. Version 2.4.0 is the first version not described as affected. A typical fix for this kind of bug is to check permissions before acting and to allow only a short, fixed list of setting names.

Step 1: Check which version you run

In your WordPress dashboard:

1. Go to Plugins > Installed Plugins.
2. Find zipMoney (Zip Co) Payments Plugin for WooCommerce (it may appear under a slightly different name).
3. Read the version number under the name.

If it says anything below 2.4.0, you are in the affected range. If you have several sites, check each one. Agencies often forget the old client site nobody has logged into for a year.

With WP-CLI (the WordPress command line tool), run this from your site folder:

wp plugin list --fields=name,title,status,version

Look for the zipMoney or Zip Co row.

Step 2: Back up, then update

Always take a backup first, so you can roll back if anything goes wrong. Your host's backup tool works. Or with WP-CLI, which writes the file to your home folder, outside the website folder:

wp db export ~/before-zip-update.sql

Never leave a database export inside your website folder. Move it somewhere private, off the web server, or delete it once you no longer need it.

Then update:

1. Go to Dashboard > Updates, or Plugins > Installed Plugins.
2. Click update now on the zipMoney plugin.
3. Confirm the version now reads 2.4.0 or higher.

Or with WP-CLI:

wp plugin update PLUGIN-SLUG

Replace PLUGIN-SLUG with the value in the name column of the wp plugin list output.

If the update does not appear, click Check Again on the Updates page. If it still doesn't show up, get the latest version from the plugin's official page and read its changelog (the list of changes). Keep your site working with a test checkout afterward: place a small order using the Zip option and make sure it still completes.

Step 3: Check whether anything was already deleted

The NVD record doesn't give details on how the flaw is triggered, so there is no reliable "fingerprint" to search your logs for. Instead, check the symptoms.

A few WP-CLI checks give a quick look at key settings:

wp option get siteurl
wp option get home
wp option get users_can_register
wp option get default_role
wp user list --role=administrator

At Users > All Users, look for administrator accounts you don't recognize. Also check your hosting access logs for unusual bursts of requests around the time anything broke. A missing setting alone does not prove a break-in, but an unknown admin account does need action.

If you find signs of tampering beyond deleted settings, follow our website hacked guide for cleanup steps.

If you can't update right now

Sometimes a payment plugin update needs testing first, or your developer is away. Until you can update:

• Deactivate and remove the plugin from Plugins > Installed Plugins. A plugin that is only deactivated can still sit on disk, so deleting it is safer. Removing it may also delete its saved settings, such as API keys and merchant credentials. Note down or export your Zip settings first, so you can set it up again after reinstalling the fixed version.
• Offer another payment method in the meantime so you don't lose sales.
• Take a fresh backup and keep it off the server, so you can restore settings quickly if something goes wrong.
• Ask your host whether they can apply a firewall rule. A firewall may reduce risk, but it is a stopgap and not a fix. Updating is the real fix.

Prevent the next one

This will not be the last plugin flaw. A few habits make the next one much less stressful:

• Turn on auto-updates for plugins you trust, or check for updates weekly.
• Delete plugins you no longer use.
• Keep tested backups, stored away from the site.
• Limit administrator accounts to people who truly need them.
• Even careful owners can be exposed by a flaw in a plugin they trust, so updates and backups matter more than perfect habits.

To see how exposed your site is overall, start with our free website security check. For a wider look at how attackers think, read is my website hackable?

Key takeaways

• Versions of the zipMoney (Zip Co) Payments Plugin for WooCommerce before 2.4.0 are affected by CVE-2026-78361, which the record lists as Critical, CVSS 9.1.
• The bug lets anyone with no login delete WordPress settings, which can break access settings, deactivate the plugin and take the site offline.
• Back up, update to 2.4.0 or newer, and test a checkout.
• Check for missing plugins, odd settings and unknown admin accounts. If you can't update, remove the plugin until you can.
• Source: the NVD record for CVE-2026-78361.

What's next

Updating closes this one hole. It doesn't tell you what else is open on your store. A Bug Circuit Circuit audit ($49, one time) has a real person go through your whole site by hand and send you a written report with severity, evidence and exact fixes. It is a focused small-site audit, not an enterprise pentest or a compliance certificate. If you'd rather have us fix the serious issues for you, see Signal and the other plans.