payOS 1.0.75 unauthenticated payment gateway settings modification

BugShield Scout discovered a missing authorisation check in payOS 1.0.75. A visitor without a WordPress account who can trigger WooCommerce to load the payOS gateway, including through checkout, can submit changes to its payment gateway configuration. In classes/class-payos.php, the gateway constructor calls payos_save_settings_and_webhook() when gateway settings and a submit field are supplied. This path does not check user capabilities or verify the nonce rendered on the administration form. If payOS accepts webhook registration with the submitted credentials, the plugin stores the supplied client ID, API key, checksum key and other gateway settings. Credential replacement therefore requires credentials accepted by payOS for webhook registration; it is not an unconditional write of arbitrary invalid credentials. A failed registration still changes the stored webhook status and clears gateway account metadata. Unauthorised configuration changes can disrupt payment processing and replace the shop's configured payOS integration. BugShield privately reported the issue on 19 October 2026. The developer confirmed that version 1.0.76 includes the fix. Source review of 1.0.76 confirms that the constructor's save path now requires POST data, a non-AJAX administration request, the manage_woocommerce capability, the WooCommerce settings page with the payOS section selected, and a valid payos_save_settings nonce. The separate WooCommerce settings-save callback also checks manage_woocommerce. Version 1.0.77 retains the constructor's access and nonce checks. BugShield reviewed the affected and fixed source packages but has not performed an independent functional retest in WordPress. The confirmed affected version is 1.0.75; earlier versions were not assessed for this advisory. High is BugShield's qualitative severity assessment; no CVE or numerical CVSS score is assigned.

Discovered by BugShield Scout. Published by BugShield.