CVE-2026-110292

MediumCVSS 6.5

Published: 28/10/2026(UTC)Updated: 28/10/2026(UTC)Translated: 28/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.22%

13th percentile - higher than 13% of all known CVEs

Summary

The PayPlug for WooCommerce (Official) WordPress plugin before 3.1.1 does not verify that the requester owns the WooCommerce order named in a payment request. Unauthenticated users could disclose another customer's order key and cancel their unpaid guest order.

Risk Assessment

An attacker may disclose another customer's order data and cancel their unpaid order, potentially causing losses and a confidentiality breach.

Recommendation

Update the PayPlug for WooCommerce (Official) plugin to version 3.1.1 or later.

Other vulnerabilities in PayPlug for WooCommerce (Official)

CVE-2026-113813Medium
The PayPlug for WooCommerce (Official) plugin before 3.1.1 does not perform any capability or ownership check on a set of unauthenticated AJAX actions that operate on a caller-supplied order identifier. This allows unauthenticated attackers to modify, read the contents of, and permanently delete arbitrary WooCommerce orders.

Original NVD description (English source)

The PayPlug for WooCommerce (Official) WordPress plugin before 3.1.1 does not verify that the requester owns the WooCommerce order named in a payment request, allowing unauthenticated users to disclose another customer's order key and cancel their unpaid guest order.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS