44 matches found
WordPress PayPlug for WooCommerce (Official) plugin 2.8.0-3.1.0 - Unauthenticated Arbitrary Order Deletion, Modification and Disclosure vulnerability
Unauthenticated Arbitrary Order Deletion, Modification and Disclosure vulnerability discovered by Sakri Rafael Koskimies in WordPress Plugin PayPlug for WooCommerce Official versions 2.8.0-3.1.0...
WordPress PayPlug for WooCommerce (Official) plugin 2.9.0-3.1.0 - Unauthenticated Order Key Disclosure and Order Cancellation vulnerability
Unauthenticated Order Key Disclosure and Order Cancellation vulnerability discovered by Filip Kecman in WordPress Plugin PayPlug for WooCommerce Official versions 2.9.0-3.1.0...
CVE-2026-113813
The PayPlug for WooCommerce Official WordPress plugin before 3.1.1 does not perform any capability or ownership check on a set of unauthenticated AJAX actions that operate on a caller-supplied order identifier, allowing unauthenticated attackers to modify, read the contents of, and permanently...
CVE-2026-110292
The PayPlug for WooCommerce Official WordPress plugin before 3.1.1 does not verify that the requester owns the WooCommerce order named in a payment request, allowing unauthenticated users to disclose another customer's order key and cancel their unpaid guest order...
EUVD-2026-111728
The PayPlug for WooCommerce Official WordPress plugin before 3.1.1 does not perform any capability or ownership check on a set of unauthenticated AJAX actions that operate on a caller-supplied order identifier, allowing unauthenticated attackers to modify, read the contents of, and permanently...
CVE-2026-113813
The PayPlug for WooCommerce (Official) WordPress plugin (versions 2.8.0-3.1.0 ) contains a vulnerability where it fails to perform capability or ownership checks on specific unauthenticated AJAX actions . An unauthenticated attacker can exploit this by providing a caller-supplied order identifier...
CVE-2026-113813 PayPlug for WooCommerce 2.8.0 - 3.1.0 - Unauthenticated Arbitrary Order Deletion, Modification and Disclosure
The PayPlug for WooCommerce Official WordPress plugin before 3.1.1 does not perform any capability or ownership check on a set of unauthenticated AJAX actions that operate on a caller-supplied order identifier, allowing unauthenticated attackers to modify, read the contents of, and permanently...
CVE-2026-113813 PayPlug for WooCommerce 2.8.0 - 3.1.0 - Unauthenticated Arbitrary Order Deletion, Modification and Disclosure
The PayPlug for WooCommerce Official WordPress plugin before 3.1.1 does not perform any capability or ownership check on a set of unauthenticated AJAX actions that operate on a caller-supplied order identifier, allowing unauthenticated attackers to modify, read the contents of, and permanently...
CVE-2026-110292 PayPlug for WooCommerce 2.9.0 - 3.1.0 - Unauthenticated Order Key Disclosure and Order Cancellation via payplug_create_intent
The PayPlug for WooCommerce Official WordPress plugin before 3.1.1 does not verify that the requester owns the WooCommerce order named in a payment request, allowing unauthenticated users to disclose another customer's order key and cancel their unpaid guest order...
CVE-2026-110292
The PayPlug for WooCommerce (Official) WordPress plugin, in versions before 3.1.1 , is vulnerable to an unauthenticated order key disclosure and order cancellation. The flaw exists because the plugin fails to verify requester ownership of a WooCommerce order specified in a payment request via the...
EUVD-2026-111709
The PayPlug for WooCommerce Official WordPress plugin before 3.1.1 does not verify that the requester owns the WooCommerce order named in a payment request, allowing unauthenticated users to disclose another customer's order key and cancel their unpaid guest order...
PT-2026-127845
The PayPlug for WooCommerce Official WordPress plugin before 3.1.1 does not perform any capability or ownership check on a set of unauthenticated AJAX actions that operate on a caller-supplied order identifier, allowing unauthenticated attackers to modify, read the contents of, and permanently...
PT-2026-127826
The PayPlug for WooCommerce Official WordPress plugin before 3.1.1 does not verify that the requester owns the WooCommerce order named in a payment request, allowing unauthenticated users to disclose another customer's order key and cancel their unpaid guest order...
CVE-2026-42637
Unauthenticated Settings Change in PayPlug for WooCommerce Official = 3.1.0 versions...
CVE-2026-39751
Unauthenticated Broken Access Control in PayPlug for WooCommerce Official = 3.1.0 versions...
CVE-2026-42637 WordPress PayPlug for WooCommerce (Official) plugin <= 3.1.0 - Settings Change vulnerability
Unauthenticated Settings Change in PayPlug for WooCommerce Official = 3.1.0 versions...
EUVD-2026-93059
Unauthenticated Settings Change in PayPlug for WooCommerce Official = 3.1.0 versions...
CVE-2026-42637 WordPress PayPlug for WooCommerce (Official) plugin <= 3.1.0 - Settings Change vulnerability
Unauthenticated Settings Change in PayPlug for WooCommerce Official = 3.1.0 versions...