Skip to content
Sign in
6.5 Medium

CVE-2026-12973 The PayPlus Payment Gateway WordPress plugin before 8.2.2 does not perform authorization or order-ownership validation…

Description

The PayPlus Payment Gateway WordPress plugin before 8.2.2 does not perform authorization or order-ownership validation in one of its AJAX actions available to unauthenticated users, allowing them to disclose the secret order key of arbitrary WooCommerce orders and, under some configurations, to modify order statuses.

Affected products and versions

Product Affected versions Fixed in
PayPlus Payment Gateway 8.2 earliest → < 8.2.2 8.2.2

Other CVEs of PayPlus Payment Gateway

The 3 CVEs of PayPlus Payment Gateway →
CVE-2026-12972 The PayPlus Payment Gateway WordPress plugin before 8.2.2 does not perform authorization or order-ownership validation… 5.3 Medium CVE-2024-6205 The PayPlus Payment Gateway WordPress plugin before 6.6.9 does not properly sanitise and escape a parameter before using… 7.6 High
Track this CVE