Payplug For Woocommerce Official
Monthly
Missing authorization checks in the PayPlug for WooCommerce (Official) WordPress plugin at version 3.1.0 and earlier let unauthenticated remote attackers reach plugin functionality that should require privileged access, degrading site integrity (CVSS 3.1 base 7.5, HIGH). The assessed vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N confirms the flaw is network-reachable, low-complexity, and requires no authentication or user interaction, and it affects WooCommerce stores running this PayPlug payment-gateway plugin within the vulnerable range; exploitation is constrained only by the need for the plugin to be installed and active. No public exploit identified at time of analysis, and no CISA KEV listing is associated with this CVE, so broad opportunistic scanning rather than confirmed active exploitation is the realistic near-term concern.
Unauthenticated settings modification in the PayPlug for WooCommerce (Official) WordPress plugin at versions up to and including 3.1.0 lets any network-reachable attacker invoke the plugin's settings-change functionality without credentials or user interaction, altering configuration data on affected WooCommerce stores (CVSS 6.5, PR:N/UI:N with limited integrity and availability impact). The root cause is a missing authorization check (CWE-862), which means the plugin exposes a settings endpoint that does not verify capability or nonce before applying changes. At time of analysis there is no public exploit code and no confirmed active exploitation (not in CISA KEV); successful abuse remains limited to sites that have this specific plugin installed, active and reachable at an affected version, and the impact is scoped to settings modification rather than full site compromise.
Missing authorization checks in the PayPlug for WooCommerce (Official) WordPress plugin at version 3.1.0 and earlier let unauthenticated remote attackers reach plugin functionality that should require privileged access, degrading site integrity (CVSS 3.1 base 7.5, HIGH). The assessed vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N confirms the flaw is network-reachable, low-complexity, and requires no authentication or user interaction, and it affects WooCommerce stores running this PayPlug payment-gateway plugin within the vulnerable range; exploitation is constrained only by the need for the plugin to be installed and active. No public exploit identified at time of analysis, and no CISA KEV listing is associated with this CVE, so broad opportunistic scanning rather than confirmed active exploitation is the realistic near-term concern.
Unauthenticated settings modification in the PayPlug for WooCommerce (Official) WordPress plugin at versions up to and including 3.1.0 lets any network-reachable attacker invoke the plugin's settings-change functionality without credentials or user interaction, altering configuration data on affected WooCommerce stores (CVSS 6.5, PR:N/UI:N with limited integrity and availability impact). The root cause is a missing authorization check (CWE-862), which means the plugin exposes a settings endpoint that does not verify capability or nonce before applying changes. At time of analysis there is no public exploit code and no confirmed active exploitation (not in CISA KEV); successful abuse remains limited to sites that have this specific plugin installed, active and reachable at an affected version, and the impact is scoped to settings modification rather than full site compromise.