PayPlug for WooCommerce EUVD-2026-111728

No special conditions beyond having the vulnerable plugin installed - remote unauthenticated exploitation against default configurations of PayPlug for WooCommerce (Official) versions 2.8.0 up to (not including) 3.1.1. The vulnerable AJAX actions perform no capability or ownership check, so no authentication, role, or configuration toggle is required. The only practical limiting factor is that the attacker must supply a target order identifier; because WooCommerce order IDs are typically sequential integers, these are readily enumerable, so this is a weak limit rather than a real barrier. Exploitation is bounded to sites running the affected version range.

This is a medium-severity (CVSS 6.5) broken-access-control flaw (CWE-862) whose signals are internally consistent but point to a moderate, not emergency, priority. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N confirms remote, unauthenticated, low-complexity exploitation with no user interaction - the most dangerous part of the profile. Against that, the exploitation-likelihood signals are low: EPSS is 0.15% (4th percentile), there is no CISA KEV listing, and no public exploit was identified, so there is no evidence of active or widespread exploitation. The vuln.today decision label is 'this_month', which aligns with a patch-this-cycle posture rather than act_now/emergency. One notable tension in the supplied data: the CVSS vector sets A:N (no availability impact) even though the description states orders can be 'permanently deleted' - permanent destruction of arbitrary order records is a material integrity/availability concern that the official 6.5 score appears to understate. Overall: a genuinely remotely exploitable authorization flaw worth prompt patching, but current threat-intel signals (low EPSS, no KEV, no confirmed exploit) indicate it is not yet under active exploitation.

An unauthenticated attacker sends crafted AJAX requests to the vulnerable PayPlug endpoints, supplying WooCommerce order identifiers (typically sequential integers that can be enumerated). Because no capability or ownership check is performed, the attacker can read the contents of other customers' orders, tamper with order data, or permanently delete arbitrary orders - all without any credentials. No public exploit code was identified, but the low complexity (AC:L) and lack of authentication (PR:N) make exploitation straightforward.