CVE-2026-12973
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
The PayPlus Payment Gateway WordPress plugin before version 8.2.2 lacks authorization and order-ownership validation in one of its AJAX actions available to unauthenticated users. This allows disclosure of the secret order key of arbitrary WooCommerce orders and, under some configurations, modification of order statuses.
Risk Assessment
An attacker can obtain secret order keys and potentially modify order statuses, compromising the confidentiality and integrity of order data.
Recommendation
Update the PayPlus Payment Gateway plugin to version 8.2.2 or later.
Other vulnerabilities in PayPlus Payment Gateway
See all- CVE-2026-93620Medium
The PayPlus Payment Gateway plugin in versions up to 8.2.5 contains a Broken Access Control vulnerability that allows an unauthenticated attacker to bypass access control mechanisms. The lack of proper permission verification enables performing operations reserved for authorized users.
- CVE-2026-12972Medium
The PayPlus Payment Gateway WordPress plugin before version 8.2.2 lacks authorization and order-ownership validation in one of its AJAX endpoints available to unauthenticated users. This allows tampering with payment metadata of arbitrary WooCommerce orders.
Original NVD description (English source)
The PayPlus Payment Gateway WordPress plugin before 8.2.2 does not perform authorization or order-ownership validation in one of its AJAX actions available to unauthenticated users, allowing them to disclose the secret order key of arbitrary WooCommerce orders and, under some configurations, to modify order statuses.