What’s Vulnerable › Vulnerabilities
CVE-2026-12973: PayPlus Payment Gateway < 8.2.2 - Unauthenticated Order Key Disclosure and Order Status Modification
- Severity: medium (CVSS 6.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-07-20 · updated 2026-07-21
- Weakness: CWE-862
Description
The PayPlus Payment Gateway WordPress plugin before 8.2.2 does not perform authorization or order-ownership validation in one of its AJAX actions available to unauthenticated users, allowing them to disclose the secret order key of arbitrary WooCommerce orders and, under some configurations, to modify order statuses.
Affected products
- PayPlus Payment Gateway: before 8.2.2 — fixed in 8.2.2
How to fix
Upgrade to a fixed version: PayPlus Payment Gateway 8.2.2. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-12973 or the next vulnerability affects your stack