EUVD-2026-45886
GHSA-hhfq-j633-m72j
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Network AJAX endpoint requires no authentication (PR:N); integrity impact is Low as only order metadata is tampered, not full system compromise.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The PayPlus Payment Gateway WordPress plugin before 8.2.2 does not perform authorization or order-ownership validation in one of its AJAX actions available to unauthenticated users, allowing them to tamper with the payment-related metadata of arbitrary WooCommerce orders.
AnalysisAI
PayPlus Payment Gateway WordPress plugin before 8.2.2 exposes an unauthenticated AJAX action that performs no authorization or order-ownership validation, enabling any remote unauthenticated actor to tamper with payment-related metadata on arbitrary WooCommerce orders across the site. A publicly available proof-of-concept exploit exists, and the SSVC framework classifies this as automatable with partial technical impact, making scripted mass-scanning of vulnerable WooCommerce shops feasible. No active exploitation is confirmed in CISA KEV, and the EPSS score of 0.13% (3rd percentile) suggests opportunistic rather than widespread exploitation at time of analysis.
Technical ContextAI
The vulnerability resides in the PayPlus Payment Gateway plugin (CPE: cpe:2.3:a:unknown:payplus_payment_gateway:*:*:*:*:*:*:*:*), a WooCommerce payment integration for WordPress. WordPress plugins commonly register AJAX actions via wp_ajax_nopriv_ hooks, which are accessible to unauthenticated visitors. CWE-284 (Improper Access Control) identifies the root cause: the affected AJAX handler neither verifies the caller's authentication state nor confirms that the requesting party owns the target order. This is a missing authorization check pattern rather than a bypass of an existing check. WooCommerce order metadata stores payment state, transaction IDs, and order status flags - fields that gate fulfillment and financial reconciliation logic. Manipulation of these fields without a corresponding legitimate payment transaction is the direct exploitation path.
RemediationAI
Upgrade the PayPlus Payment Gateway plugin to version 8.2.2 or later immediately - this is the vendor-confirmed patched release, as documented at https://wpscan.com/vulnerability/dcd091d3-f830-4675-a3d5-926f4aa5a7a5/. If immediate upgrade is not feasible, the most effective compensating control is to deactivate the plugin entirely until patching is possible, as this removes the vulnerable AJAX endpoint from the attack surface; the trade-off is loss of payment processing capability via this gateway. If deactivation is also not viable, restricting access to WordPress AJAX endpoints (wp-admin/admin-ajax.php) via a web application firewall rule or IP allowlist for non-authenticated traffic would reduce exposure, though this may break legitimate front-end functionality. Update through the WordPress admin panel under Plugins > Installed Plugins or via WP-CLI with 'wp plugin update payplus-payment-gateway'.
More in Payplus Payment Gateway
View allThe PayPlus Payment Gateway WordPress plugin before 6.6.9 does not properly sanitise and escape a parameter before using
PayPlus Payment Gateway WordPress plugin before 8.2.2 exposes an unauthenticated AJAX action that performs no authorizat
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in PayPlus LTD
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today