medium6.5
CVE-2026-113813
The PayPlug for WooCommerce (Official) WordPress plugin before 3.1.1 does not perform any capability or ownership check on a set of unauthenticated AJAX action…
Impact
The PayPlug for WooCommerce (Official) WordPress plugin before 3.1.1 does not perform any capability or ownership check on a set of unauthenticated AJAX actions that operate on a caller-supplied order identifier, allowing unauthenticated attackers to modify, read the contents of, and permanently delete arbitrary WooCommerce orders.
Affected products
| Product | Affected versions |
|---|---|
| PayPlug For WooCommerce (Official) WordPress Plugin | before 3.1.1 |
Versions were read from the advisory text. No structured product data has been published for this record yet.