Skip to content
CVE PROGRAM SOURCE RECORD5.3 Medium

CVE-2026-12972

PayPlus Payment Gateway < 8.2.2 - Unauthenticated Order Payment Metadata Tampering

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
WPScan

Description

The PayPlus Payment Gateway WordPress plugin before 8.2.2 does not perform authorization or order-ownership validation in one of its AJAX actions available to unauthenticated users, allowing them to tamper with the payment-related metadata of arbitrary WooCommerce orders.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Unknown PayPlus Payment Gateway

Default version status: unaffected

  • 0 to < 8.2.2affected

References