CVE-2026-110292 PayPlug for WooCommerce 2.9.0 - 3.1.0 - Unauthenticated Order Key Disclosure and Order Cancellation via payplug_create_intent

The PayPlug for WooCommerce Official WordPress plugin before 3.1.1 does not verify that the requester owns the WooCommerce order named in a payment request, allowing unauthenticated users to disclose another customer's order key and cancel their unpaid guest order...

CVE-2026-110292

The PayPlug for WooCommerce (Official) WordPress plugin, in versions before 3.1.1 , is vulnerable to an unauthenticated order key disclosure and order cancellation. The flaw exists because the plugin fails to verify requester ownership of a WooCommerce order specified in a payment request via the...