6.5
Moyenne
CVE-2026-110292 The PayPlug for WooCommerce (Official) WordPress plugin before 3.1.1 does not verify that the requester owns the…
Description
The PayPlug for WooCommerce (Official) WordPress plugin before 3.1.1 does not verify that the requester owns the WooCommerce order named in a payment request, allowing unauthenticated users to disclose another customer's order key and cancel their unpaid guest order.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| PayPlug for WooCommerce (Official) 2.9 | 2.9.0 → < 3.1.1 | 3.1.1 |