EUVD-2026-93260
GHSA-24gg-q9vh-xg9v
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Unauthenticated network-reachable missing-authorization flaw (AV:N/AC:L/PR:N/UI:N); broken access control enables state tampering (I:H) with no disclosure or availability impact (C:N/A:N).
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
3DescriptionCVE.org
Unauthenticated Broken Access Control in PayPlug for WooCommerce (Official) <= 3.1.0 versions.
AnalysisAI
Missing authorization checks in the PayPlug for WooCommerce (Official) WordPress plugin at version 3.1.0 and earlier let unauthenticated remote attackers reach plugin functionality that should require privileged access, degrading site integrity (CVSS 3.1 base 7.5, HIGH). The assessed vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N confirms the flaw is network-reachable, low-complexity, and requires no authentication or user interaction, and it affects WooCommerce stores running this PayPlug payment-gateway plugin within the vulnerable range; exploitation is constrained only by the need for the plugin to be installed and active. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target WordPress site has the PayPlug for WooCommerce (Official) plugin installed and active at version 3.1.0 or earlier; the vulnerable authorization-missing endpoint must be network-reachable. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The input provides a CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N (base 7.5, HIGH), indicating a network-reachable, low-complexity, unauthenticated flaw with no user interaction that impacts integrity only (C:N/A:N). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch identified at time of analysis; the only reference supplied is the Patchstack advisory, which documents the issue at the 3.1.0 boundary but does not publish an exact fixed version, so confirm the current release on the PayPlug for WooCommerce plugin page and the WordPress.org plugin repository before upgrading, and treat any version above 3.1.0 as unverified until the vendor publishes a changelog entry. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all WordPress installations for the PayPlug for WooCommerce (Official) plugin and confirm which run version 3.1.0 or earlier; where PayPlug is not essential to current checkout operations, deactivate and remove the plugin immediately, and for stores that must keep it active, place compensating WAF rules in front of wp-admin and the plugin endpoints, restrict administrative access by IP allowlist, and enable file-integrity and audit logging to detect unauthorized changes. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Woocommerce
View allThe WooCommerce plugin through 3.x for WordPress has a Directory Traversal Vulnerability via a /wp-content/plugins/wooco
The WooCommerce Help Scout WordPress plugin before 2.9.1 (https://woocommerce.com/products/woocommerce-help-scout/) allo
WooCommerce 7.1.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary PHP code by
Ultimate WooCommerce Gift Cards 3.0.2 is affected by a file upload vulnerability in the Custom GiftCard Template that ca
Unauthenticated SQL injection in the ELEX WooCommerce Request a Quote WordPress plugin (all versions before 2.4.1) allow
Unauthenticated, network-reachable attackers can read the WooCommerce API consumer key and secret stored by the MgoSync
Unauth. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low atta
An issue was discovered in the NAB Transact extension 2.1.0 for the WooCommerce plugin for WordPress. Rated high severit
Privilege escalation in MultiVendorX WordPress plugin before 5.0.16 allows authenticated vendor-role users to grant admi
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WooComm
Unauthenticated information disclosure in the Geliver Akıllı Kargo Pazaryeri WordPress plugin (versions 3.0.0 through 3.
Authenticated attackers with only Subscriber-level access can mint wallet funds for themselves or drain a specific victi
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today