Skip to content
Sign in
5.3 Medium

CVE-2026-12972 The PayPlus Payment Gateway WordPress plugin before 8.2.2 does not perform authorization or order-ownership validation…

Description

The PayPlus Payment Gateway WordPress plugin before 8.2.2 does not perform authorization or order-ownership validation in one of its AJAX actions available to unauthenticated users, allowing them to tamper with the payment-related metadata of arbitrary WooCommerce orders.

Affected products and versions

Product Affected versions Fixed in
PayPlus Payment Gateway 8.2 earliest → < 8.2.2 8.2.2

Other CVEs of PayPlus Payment Gateway

The 3 CVEs of PayPlus Payment Gateway →
CVE-2026-12973 The PayPlus Payment Gateway WordPress plugin before 8.2.2 does not perform authorization or order-ownership validation… 6.5 Medium CVE-2024-6205 The PayPlus Payment Gateway WordPress plugin before 6.6.9 does not properly sanitise and escape a parameter before using… 7.6 High
Track this CVE