PayPlug WooCommerce EUVD-2026-111709

No special conditions beyond the plugin being installed and active - remote unauthenticated exploitation works against default configurations of PayPlug for WooCommerce (Official) versions 2.9.0 up to (but not including) 3.1.1. The specific trigger is a payment request naming a WooCommerce order that the requester does not own; the plugin fails to verify ownership (CWE-200). Practical impact is limited to orders that are unpaid guest orders - the disclosure/cancellation applies to that order state, and the flaw does not grant authentication, code execution, or access to stored payment credentials. The only real limiting factor is that the victim order must exist and be an unpaid guest order; no user interaction or privileges are required of the attacker.

This is a genuine but moderate-priority issue, not a critical emergency. The CVSS 3.1 base of 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) correctly reflects a remotely reachable, unauthenticated flaw with only limited confidentiality and integrity impact (order-key disclosure and cancellation of unpaid guest orders) and no availability impact. The signals are internally consistent and point away from urgent, widespread exploitation: EPSS is 0.16% (6th percentile), there is no CISA KEV listing (not actively exploited per available data), and no exploit/PoC code is shown in the input. The vuln.today decision label is 'this_month' rather than act_now/emergency, aligning with the low EPSS and absence of KEV. No SSVC decision string (exploitation/automatable/technical-impact) was supplied, so that framework cannot be independently cross-referenced. The main thing elevating practical risk is PR:N - exploitation needs no authentication and no user interaction - but the business impact is bounded (an attacker can enumerate/cancel other customers' unpaid guest orders and read their order keys, not take over the store or steal payment credentials). Treat as a standard scheduled patch, not a drop-everything event.

An unauthenticated attacker crafts payment-related requests to the PayPlug plugin referencing a WooCommerce order they do not own; because ownership is never verified, the response discloses the victim's order key and the attacker can cancel that customer's unpaid guest order. No public exploit code is identified in the input, but the attack is simple HTTP request manipulation requiring no credentials or user interaction, so weaponization effort is low.