Critical flaw hits Sipay's OpenCart payment plugin — but check who that actually is first

A fresh entry in the US National Vulnerability Database is flashing near-maximum severity — 9.8 out of 10 — which is the kind of number that tends to get forwarded around security Slack channels with lots of exclamation marks. The reality, as usual, is narrower than the headline score suggests.

What the bug actually does

CVE-2026-85531, published on 9 October, concerns the Virtual POS Module built for OpenCart by Sipay, a Turkish electronic money and payment services provider. The flaw is described as “improper verification of cryptographic signature”, which in plain terms means the module doesn’t properly check that a signed message — the kind used to confirm a payment is genuine and hasn’t been tampered with — actually came from where it claims to. That opens the door to signature spoofing, where an attacker crafts a fake but accepted signature to trick the system into validating something it shouldn’t.

For a payment component, this is about as serious a bug class as exists: if signatures can be forged, the module’s whole job of confirming a transaction is legitimate falls apart. That’s almost certainly why the score sits so high.

So who is actually at risk

This is not a vulnerability in OpenCart itself, and it’s not a general e-commerce scare. It’s specific to merchants running the Sipay Virtual POS add-on for OpenCart — a relatively niche combination of a specific shopping-cart platform and a specific Turkish payment processor’s plugin. The Turkish national cyber security notification service, siberguvenlik.gov.tr, has also flagged it, which tracks with the geography of who’s likely using it.

If you’ve never heard of Sipay, that’s fine — you’re not the audience for this one. If you run an OpenCart store and have no idea which payment gateway modules are installed, now’s a sensible moment to check.

What’s still unknown

The advisory text available so far is thin on specifics that actually matter day-to-day:

• Is it patched? Not stated in the current listing. No fixed version number appears in the source material reviewed.
• Is it being exploited in the wild? No evidence of active exploitation has been cited anywhere in the disclosure.
• How widely is it installed? OpenCart itself is a mid-size open-source platform, but Sipay’s module is a narrow slice of that ecosystem, and no install-base figures are published alongside the CVE.

A 9.8 score reflects the technical severity of what the bug could allow, not how many people are exposed to it or whether anyone’s actively abusing it. Those are three separate questions, and right now only the first has a solid answer.

What to do about it

If you’re an OpenCart merchant using Sipay’s Virtual POS integration, the sensible move is to check with Sipay directly for a patched release, review recent transaction logs for anything anomalous, and avoid treating payment confirmations from the module as fully trustworthy until an update lands. Everyone else — including the vast majority of online shoppers and most OpenCart users on other gateways — isn’t in the blast radius here.

High CVSS scores are a useful triage signal, not a verdict. This one is worth a look if it applies to your stack, and safely ignorable if it doesn’t.