CVE-2026-12973

MEDIUM

PayPlus Payment Gateway < 8.2.2 - Unauthenticated Order Key Disclosure and Order Status Modification

Title source: cna

Description

The PayPlus Payment Gateway WordPress plugin before 8.2.2 does not perform authorization or order-ownership validation in one of its AJAX actions available to unauthenticated users, allowing them to disclose the secret order key of arbitrary WooCommerce orders and, under some configurations, to modify order statuses.

References (1)

Core 1

Core References

Exploit exploit vdb-entry technical-description

https://wpscan.com/vulnerability/385bee73-f9e5-425e-aa4c-3ff9274f8e00/

Scores

CVSS v3 6.5

EPSS 0.0016

EPSS Percentile 5.6%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation poc

Automatable yes

Technical Impact partial

Details

CWE

CWE-862

Status published

Products (1)

None/PayPlus Payment Gateway < 8.2.2

Published Jul 20, 2026

Tracked Since Jul 20, 2026