CVE-2026-80339 Payment Plugins for Stripe WooCommerce < 4.0.12 - Unauthenticated Customer PII Disclosure via order-pay

The Payment Plugins for Stripe WooCommerce WordPress plugin before 4.0.12 does not validate the order key before adding order data to the JavaScript configuration it outputs on the front end, allowing unauthenticated users to obtain the billing details of any order, together with the secret that...

WordPress WP Helper Premium plugin < 4.7.6 - Unauthenticated Order Data Disclosure and Order Manipulation via Missing Order Key Validation vulnerability

Unauthenticated Order Data Disclosure and Order Manipulation via Missing Order Key Validation vulnerability discovered by Farid Narimanov in WordPress Plugin WP Helper Premium versions 4.7.6...

CVE-2026-18945 WP Helper Premium < 4.7.6 - Unauthenticated Order Data Disclosure and Order Manipulation via Missing Order Key Validation

The WP Helper Premium WordPress plugin before 4.7.6 does not verify the order key when rendering its custom order confirmation page or when handling the related AJAX actions, allowing unauthenticated users to view other customers' order details, including personal information, as well as change t...

CVE-2026-18945

The WP Helper Premium WordPress plugin (versions before 4.7.6 ) fails to verify the order key when rendering its custom order confirmation page or handling related AJAX actions. This vulnerability allows unauthenticated users to view other customers' order details, including personal information ...