Payplus Payment Gateway
Monthly
PayPlus Payment Gateway WordPress plugin before 8.2.2 exposes an unauthenticated AJAX action that performs no authorization or order-ownership validation, allowing any remote, unauthenticated attacker to retrieve the secret order key of arbitrary WooCommerce orders. Under certain plugin configurations, the same endpoint additionally permits modification of order statuses, extending impact to data integrity. A publicly available proof-of-concept exists per WPScan reporting, though EPSS sits at only 0.13% (3rd percentile), indicating limited observed exploitation despite the SSVC Automatable=yes classification - no public exploit identified at time of analysis beyond the POC, and this CVE is not currently listed in CISA KEV.
PayPlus Payment Gateway WordPress plugin before 8.2.2 exposes an unauthenticated AJAX action that performs no authorization or order-ownership validation, enabling any remote unauthenticated actor to tamper with payment-related metadata on arbitrary WooCommerce orders across the site. A publicly available proof-of-concept exploit exists, and the SSVC framework classifies this as automatable with partial technical impact, making scripted mass-scanning of vulnerable WooCommerce shops feasible. No active exploitation is confirmed in CISA KEV, and the EPSS score of 0.13% (3rd percentile) suggests opportunistic rather than widespread exploitation at time of analysis.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in PayPlus LTD PayPlus Payment Gateway allows Reflected XSS.6.8. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The PayPlus Payment Gateway WordPress plugin before 6.6.9 does not properly sanitise and escape a parameter before using it in a SQL statement via a WooCommerce API route available to unauthenticated. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
PayPlus Payment Gateway WordPress plugin before 8.2.2 exposes an unauthenticated AJAX action that performs no authorization or order-ownership validation, allowing any remote, unauthenticated attacker to retrieve the secret order key of arbitrary WooCommerce orders. Under certain plugin configurations, the same endpoint additionally permits modification of order statuses, extending impact to data integrity. A publicly available proof-of-concept exists per WPScan reporting, though EPSS sits at only 0.13% (3rd percentile), indicating limited observed exploitation despite the SSVC Automatable=yes classification - no public exploit identified at time of analysis beyond the POC, and this CVE is not currently listed in CISA KEV.
PayPlus Payment Gateway WordPress plugin before 8.2.2 exposes an unauthenticated AJAX action that performs no authorization or order-ownership validation, enabling any remote unauthenticated actor to tamper with payment-related metadata on arbitrary WooCommerce orders across the site. A publicly available proof-of-concept exploit exists, and the SSVC framework classifies this as automatable with partial technical impact, making scripted mass-scanning of vulnerable WooCommerce shops feasible. No active exploitation is confirmed in CISA KEV, and the EPSS score of 0.13% (3rd percentile) suggests opportunistic rather than widespread exploitation at time of analysis.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in PayPlus LTD PayPlus Payment Gateway allows Reflected XSS.6.8. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The PayPlus Payment Gateway WordPress plugin before 6.6.9 does not properly sanitise and escape a parameter before using it in a SQL statement via a WooCommerce API route available to unauthenticated. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.