CVE-2026-12972
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
The PayPlus Payment Gateway WordPress plugin before version 8.2.2 lacks authorization and order-ownership validation in one of its AJAX endpoints available to unauthenticated users. This allows tampering with payment metadata of arbitrary WooCommerce orders.
Risk Assessment
An attacker can alter payment data in other customers' orders, potentially leading to unauthorized transactions or financial fraud.
Recommendation
Update the PayPlus Payment Gateway plugin to version 8.2.2 or later.
Other vulnerabilities in PayPlus Payment Gateway
See all- CVE-2026-93620Medium
The PayPlus Payment Gateway plugin in versions up to 8.2.5 contains a Broken Access Control vulnerability that allows an unauthenticated attacker to bypass access control mechanisms. The lack of proper permission verification enables performing operations reserved for authorized users.
- CVE-2026-12973Medium
The PayPlus Payment Gateway WordPress plugin before version 8.2.2 lacks authorization and order-ownership validation in one of its AJAX actions available to unauthenticated users. This allows disclosure of the secret order key of arbitrary WooCommerce orders and, under some configurations, modification of order statuses.
Original NVD description (English source)
The PayPlus Payment Gateway WordPress plugin before 8.2.2 does not perform authorization or order-ownership validation in one of its AJAX actions available to unauthenticated users, allowing them to tamper with the payment-related metadata of arbitrary WooCommerce orders.