CVE-2026-93620
MediumCVSS 6.5Summary
The PayPlus Payment Gateway plugin in versions up to 8.2.5 contains a Broken Access Control vulnerability that allows an unauthenticated attacker to bypass access control mechanisms. The lack of proper permission verification enables performing operations reserved for authorized users.
Risk Assessment
An unauthenticated attacker can access payment-related functions or data, potentially leading to unauthorized transactions or data leakage. This affects the confidentiality and integrity of the payment system.
Recommendation
Update the PayPlus Payment Gateway plugin to a version later than 8.2.5 that contains the fix for this vulnerability. If updating is not possible, consider disabling the plugin until the patch can be applied.
Other vulnerabilities in PayPlus Payment Gateway
See all- CVE-2026-12973Medium
The PayPlus Payment Gateway WordPress plugin before version 8.2.2 lacks authorization and order-ownership validation in one of its AJAX actions available to unauthenticated users. This allows disclosure of the secret order key of arbitrary WooCommerce orders and, under some configurations, modification of order statuses.
- CVE-2026-12972Medium
The PayPlus Payment Gateway WordPress plugin before version 8.2.2 lacks authorization and order-ownership validation in one of its AJAX endpoints available to unauthenticated users. This allows tampering with payment metadata of arbitrary WooCommerce orders.
Original NVD description (English source)
Unauthenticated Broken Access Control in PayPlus Payment Gateway <= 8.2.5 versions.