CVE-2026-42637

MediumCVSS 6.5

Published: 06/10/2026(UTC)Updated: 06/10/2026(UTC)Translated: 06/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.33%

24th percentile - higher than 24% of all known CVEs

Summary

The vulnerability allows an unauthenticated attacker to change settings in the PayPlug for WooCommerce (Official) plugin in versions up to and including 3.1.0.

Risk Assessment

An unauthenticated attacker can modify plugin configuration, potentially leading to unauthorized changes in payment settings or takeover of the shop.

Recommendation

Update the PayPlug for WooCommerce plugin to the latest version that includes a fix for this vulnerability.

Other vulnerabilities in PayPlug for WooCommerce

CVE-2026-39751High
A vulnerability in the PayPlug for WooCommerce (Official) plugin up to version 3.1.0 allows an unauthenticated attacker to exploit broken access control.

Original NVD description (English source)

Unauthenticated Settings Change in PayPlug for WooCommerce (Official) <= 3.1.0 versions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS