medium5.3
CVE-2026-12972
The PayPlus Payment Gateway WordPress plugin before 8.2.2 does not perform authorization or order-ownership validation in one of its AJAX actions available to …
Impact
The PayPlus Payment Gateway WordPress plugin before 8.2.2 does not perform authorization or order-ownership validation in one of its AJAX actions available to unauthenticated users, allowing them to tamper with the payment-related metadata of arbitrary WooCommerce orders.
Affected products
| Product | Affected versions |
|---|---|
| PayPlus Payment Gateway WordPress Plugin | before 8.2.2 |
Versions were read from the advisory text. No structured product data has been published for this record yet.