6.5
Medium
CVE-2026-110292 The PayPlug for WooCommerce (Official) WordPress plugin before 3.1.1 does not verify that the requester owns the…
Description
The PayPlug for WooCommerce (Official) WordPress plugin before 3.1.1 does not verify that the requester owns the WooCommerce order named in a payment request, allowing unauthenticated users to disclose another customer's order key and cancel their unpaid guest order.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| PayPlug for WooCommerce (Official) 2.9 | 2.9.0 → < 3.1.1 | 3.1.1 |