EUVD-2026-85463
GHSA-9v5p-4w93-45x5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site running PayPlus plugin ≤8.2.5
-
ExploitSend crafted request to unprotected endpoint
-
ExecutionBypass missing authorization check (CWE-862)
-
ImpactRead or modify payment/order data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The target must run the PayPlus Payment Gateway WordPress plugin at version 8.2.5 or earlier with the affected endpoint reachable over the network. Per the CVSS vector (PR:N/UI:N/AC:L), no authentication, user interaction, or non-default configuration is stated as required - exploitation works against a default installation of the vulnerable plugin. The primary limiting factor is deployment scope: only WordPress sites that have this specific (niche) payment plugin installed and activated are exposed, and impact is bounded to the partial confidentiality/integrity effects (C:L/I:L) rather than full site or transaction compromise. |
| Impact | The vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N = 6.5 Medium) describes a remotely reachable, low-complexity, unauthenticated missing-authorization flaw (CWE-862) with partial confidentiality and integrity impact and no availability effect. No EPSS score, CISA KEV entry, or public POC is present in the provided data, so exploitation status is 'no public exploit identified at time of analysis.' There is no SSVC decision record supplied. The realistic risk is moderate rather than critical: the unauthenticated network vector is the main aggravating signal, but the limited C:L/I:L impacts (partial disclosure/manipulation, not full account or data compromise) and the absence of any exploitation evidence keep this below emergency priority. Because the affected product is a payment-gateway plugin, even partial integrity/confidentiality impact on order or transaction data deserves prompt patching where deployed, but the missing EPSS/KEV/POC data means no evidence of widespread or targeted exploitation. Only a single Patchstack reference is provided and no fix version is listed, so remediation availability could not be confirmed from the input. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends a crafted request directly to a plugin endpoint that fails to enforce an authorization/capability check, accessing or altering payment-gateway data (e.g., order or transaction details) they should not reach. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no credentials, user interaction, or special complexity is required. No public proof-of-concept is identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 23, 2026
Unauthenticated broken access control in the PayPlus Payment Gateway WordPress plugin (versions 8.2.5 and earlier) lets remote attackers reach plugin functionality that lacks proper authorization checks, yielding partial confidentiality and integrity impact. Per the vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, 6.5 Medium), exploitation requires no authentication, no user interaction, and no non-default configuration, so any WordPress site running this niche payment plugin at a vulnerable version is exposed over the network. Exposure is limited to sites with the plugin installed and active, availability is unaffected, and no public exploit code or confirmed active exploitation was identified at time of analysis; Patchstack is credited with the report.
RemediationAI
No vendor-released patch version is identified in the available data; the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/payplus-payment-gateway/vulnerability/wordpress-payplus-payment-gateway-plugin-8-2-5-broken-access-control-vulnerability?_s_id=cve is the authoritative tracking reference and should be monitored for a fixed release, after which upgrading the plugin beyond 8.2.5 is the primary fix. Until a patched version is confirmed, the most reliable compensating control is to deactivate and remove the PayPlus Payment Gateway plugin on sites that do not require it, accepting the loss of PayPlus payment functionality; for sites that must keep it, restrict network access to the plugin's endpoints via WAF or reverse-proxy rules that block unauthenticated requests to PayPlus plugin paths, understanding that overly broad rules can break legitimate checkout callbacks and that WAF bypasses are possible. Additionally, review web-server and plugin logs for anomalous unauthenticated requests to PayPlus routes and confirm that no unexpected configuration or data changes occurred, keeping in mind that logging provides detection only and does not prevent exploitation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-862 Missing Authorization issue in a WordPress payment-gateway plugin, meaning an endpoint or action registered by the plugin enforces no capability or nonce check before performing privileged operations, allowing the request to be processed in an unauthenticated context. The affected component is identified by the CPE cpe:2.3:a:payplus_tech_team:payplus_payment_gateway:*:*:*:*:*:*:*:*, with ENISA EUVD entry EUVD-2026-85463 listing all versions up to and including 8.2.5 as affected, and the vulnerability is catalogued by Patchstack under the 'Authentication Bypass' tag. Because the CVSS vector carries PR:N and UI:N with AC:L, the missing-authorization class here is directly reachable rather than gated behind a login, and the scope is unchanged with only partial (C:L/I:L) confidentiality and integrity effects, consistent with access to a bounded set of data or state rather than full site or transaction takeover.
Know when Payplus Payment Gateway gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Unauthenticated network-reachable missing-authorization flaw (PR:N/AV:N/AC:L) with partial data disclosure and manipulation (C:L/I:L) and no availability impact, matching the vendor vector.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Broken Access Control in PayPlus Payment Gateway <= 8.2.5 versions.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Payplus Payment Gateway
View allThe PayPlus Payment Gateway WordPress plugin before 6.6.9 does not properly sanitise and escape a parameter before using
PayPlus Payment Gateway WordPress plugin before 8.2.2 exposes an unauthenticated AJAX action that performs no authorizat
PayPlus Payment Gateway WordPress plugin before 8.2.2 exposes an unauthenticated AJAX action that performs no authorizat
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in PayPlus LTD
Exploit-DB