CVE-2026-113813

MediumCVSS 6.5

Published: 28/10/2026(UTC)Updated: 28/10/2026(UTC)Translated: 28/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.21%

11th percentile - higher than 11% of all known CVEs

Summary

The PayPlug for WooCommerce (Official) plugin before 3.1.1 does not perform any capability or ownership check on a set of unauthenticated AJAX actions that operate on a caller-supplied order identifier. This allows unauthenticated attackers to modify, read the contents of, and permanently delete arbitrary WooCommerce orders.

Risk Assessment

An unauthenticated attacker can modify, read and delete customer orders, leading to personal data leakage and sales disruption. This may have serious business and legal (GDPR) consequences.

Recommendation

Update the PayPlug for WooCommerce plugin to version 3.1.1 or later. Verify order integrity and review logs for unauthorized operations.

Other vulnerabilities in PayPlug for WooCommerce (Official)

CVE-2026-110292Medium
The PayPlug for WooCommerce (Official) WordPress plugin before 3.1.1 does not verify that the requester owns the WooCommerce order named in a payment request. Unauthenticated users could disclose another customer's order key and cancel their unpaid guest order.

Original NVD description (English source)

The PayPlug for WooCommerce (Official) WordPress plugin before 3.1.1 does not perform any capability or ownership check on a set of unauthenticated AJAX actions that operate on a caller-supplied order identifier, allowing unauthenticated attackers to modify, read the contents of, and permanently delete arbitrary WooCommerce orders.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS