PayPlus Payment Gateway vulnerabilities
3 known CVE vulnerabilities in PayPlus Payment Gateway, translated and rated.
- CVE-2026-93620Medium
The PayPlus Payment Gateway plugin in versions up to 8.2.5 contains a Broken Access Control vulnerability that allows an unauthenticated attacker to bypass access control mechanisms. The lack of proper permission verification enables performing operations reserved for authorized users.
- CVE-2026-12973Medium
The PayPlus Payment Gateway WordPress plugin before version 8.2.2 lacks authorization and order-ownership validation in one of its AJAX actions available to unauthenticated users. This allows disclosure of the secret order key of arbitrary WooCommerce orders and, under some configurations, modification of order statuses.
- CVE-2026-12972Medium
The PayPlus Payment Gateway WordPress plugin before version 8.2.2 lacks authorization and order-ownership validation in one of its AJAX endpoints available to unauthenticated users. This allows tampering with payment metadata of arbitrary WooCommerce orders.