medium6.5
CVE-2026-110292
The PayPlug for WooCommerce (Official) WordPress plugin before 3.1.1 does not verify that the requester owns the WooCommerce order named in a payment request, …
Impact
The PayPlug for WooCommerce (Official) WordPress plugin before 3.1.1 does not verify that the requester owns the WooCommerce order named in a payment request, allowing unauthenticated users to disclose another customer's order key and cancel their unpaid guest order.
Affected products
| Product | Affected versions |
|---|---|
| PayPlug For WooCommerce (Official) WordPress Plugin | before 3.1.1 |
Versions were read from the advisory text. No structured product data has been published for this record yet.