CVE-2026-12973 - PayPlus Payment Gateway < 8.2.2 - Unauthenticated Order Key Disclosure and Order Status Modification

Back Back to CVE browser

MEDIUM

PayPlus Payment Gateway < 8.2.2 - Unauthenticated Order Key Disclosure and Order Status Modification

Published Jul 20, 2026

6.5

MEDIUM

CVSS 3.1

EPSS 0.27%

Description

The PayPlus Payment Gateway WordPress plugin before 8.2.2 does not perform authorization or order-ownership validation in one of its AJAX actions available to unauthenticated users, allowing them to disclose the secret order key of arbitrary WooCommerce orders and, under some configurations, to modify order statuses.

Affected products

Vendor n/a Product PayPlus Payment Gateway Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <8.2.2

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

PayPlus Payment Gateway

unaffected

Version	Status	Constraints
0	affected	<8.2.2

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-862

Missing Authorization

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-45887
Advisory
https://wpscan.com/vulnerability/385bee73-f9e5-425e-aa4c-3ff9274f8e00/
exploitvdb-entrytechnical-description

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-45887		Advisory
https://wpscan.com/vulnerability/385bee73-f9e5-425e-aa4c-3ff9274f8e00/		exploitvdb-entrytechnical-description