CVE-2026-113813

The PayPlug for WooCommerce (Official) WordPress plugin, in versions before 3.1.1 , is vulnerable to unauthorized access due to a lack of capability or ownership checks on specific unauthenticated AJAX actions . An unauthenticated attacker can use a caller-supplied order identifier to modify , re...

CVE-2026-113813 PayPlug for WooCommerce 2.8.0 - 3.1.0 - Unauthenticated Arbitrary Order Deletion, Modification and Disclosure

The PayPlug for WooCommerce Official WordPress plugin before 3.1.1 does not perform any capability or ownership check on a set of unauthenticated AJAX actions that operate on a caller-supplied order identifier, allowing unauthenticated attackers to modify, read the contents of, and permanently...