CVE-2026-12966

The Direct Payments for WooCommerce WordPress plugin (versions before 2.5.3 ) is vulnerable to unauthenticated cross-customer order tampering. The root cause is a failure to verify requester ownership of a targeted WooCommerce order within several unauthenticated AJAX handlers . This allows unaut...