EUVD-2026-45887
GHSA-892x-54hq-8c85
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Unauthenticated network AJAX endpoint with no complexity barrier; integrity impact limited and configuration-conditional, no availability impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The PayPlus Payment Gateway WordPress plugin before 8.2.2 does not perform authorization or order-ownership validation in one of its AJAX actions available to unauthenticated users, allowing them to disclose the secret order key of arbitrary WooCommerce orders and, under some configurations, to modify order statuses.
AnalysisAI
PayPlus Payment Gateway WordPress plugin before 8.2.2 exposes an unauthenticated AJAX action that performs no authorization or order-ownership validation, allowing any remote, unauthenticated attacker to retrieve the secret order key of arbitrary WooCommerce orders. Under certain plugin configurations, the same endpoint additionally permits modification of order statuses, extending impact to data integrity. A publicly available proof-of-concept exists per WPScan reporting, though EPSS sits at only 0.13% (3rd percentile), indicating limited observed exploitation despite the SSVC Automatable=yes classification - no public exploit identified at time of analysis beyond the POC, and this CVE is not currently listed in CISA KEV.
Technical ContextAI
The vulnerability resides in the PayPlus Payment Gateway plugin (CPE: cpe:2.3:a:unknown:payplus_payment_gateway:*:*:*:*:*:*:*:*) for WordPress, which provides WooCommerce payment processing integration. CWE-862 (Missing Authorization) describes the root cause: a WordPress AJAX handler - likely registered via wp_ajax_nopriv_ to serve unauthenticated requests - executes sensitive order-related logic without verifying that the requesting party owns or is authorized to access the target order. WooCommerce secret order keys are per-order tokens used for payment callbacks and order verification; exposure of these keys can enable downstream abuse such as order-state manipulation or payment flow interference. The vulnerability is configuration-sensitive for the integrity component, meaning order-status modification may require specific PayPlus or WooCommerce configuration states beyond a default install.
RemediationAI
Upgrade PayPlus Payment Gateway to version 8.2.2 or later, which resolves the missing authorization flaw per the vendor patch. The patch is confirmed available from the vendor advisory referenced at https://wpscan.com/vulnerability/385bee73-f9e5-425e-aa4c-3ff9274f8e00/ and corroborated by NVD at https://nvd.nist.gov/vuln/detail/CVE-2026-12973. If immediate upgrade is not possible, a specific compensating control is to disable or firewall the vulnerable AJAX endpoint at the WAF or web server level - identify the specific wp-admin/admin-ajax.php action parameter associated with PayPlus order queries and block unauthenticated POST requests to it; note this may disrupt legitimate frontend checkout flows and should be tested. Alternatively, temporarily deactivating the PayPlus plugin eliminates the attack surface entirely at the cost of payment processing availability. There are no known workarounds that preserve full plugin functionality while mitigating this specific flaw.
More in Payplus Payment Gateway
View allThe PayPlus Payment Gateway WordPress plugin before 6.6.9 does not properly sanitise and escape a parameter before using
PayPlus Payment Gateway WordPress plugin before 8.2.2 exposes an unauthenticated AJAX action that performs no authorizat
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in PayPlus LTD
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today