CVE-2026-110292

The PayPlug for WooCommerce (Official) WordPress plugin before 3.1.1 does not verify that the requester owns the WooCommerce order named in a payment request, allowing unauthenticated users to disclose another customer's order key and cancel their unpaid guest order.

Score

CVSS 3.1 6.5 Medium

Status

Deferred - contact@wpscan.com

Published

2026-10-28

Last modified

2026-10-28

Weaknesses

CWE-200

Affected products

• Payplug For Woocommerce Official (Unknown)

References

• https://wpscan.com/vulnerability/91444324-4332-489e-9e97-f371d866c20c/