CVE-2026-110292 Details
Description
The PayPlug for WooCommerce (Official) WordPress plugin before 3.1.1 does not verify that the requester owns the WooCommerce order named in a payment request, allowing unauthenticated users to disclose another customer's order key and cancel their unpaid guest order.
A vulnerability exists in the PayPlug for WooCommerce WordPress plugin, specifically in versions prior to 3.1.1. The issue arises because the plugin does not properly verify that the requester owns the WooCommerce order referenced in a payment request. This flaw allows unauthenticated users to access another customer's order key and cancel their unpaid guest orders.
Users are advised to update the PayPlug for WooCommerce WordPress plugin to version 3.1.1 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 28, 2026CISA-ADP
Assessed Oct 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://wpscan.com/vulnerability/91444324-4332-489e-9e97-f371d866c20c/ | [email protected] | AdvisoryExploitRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| PayPlug | >= 2.9.0, <= 3.1.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 28, 2026 | CVE Modified | CISA-ADP |
| Oct 28, 2026 | New CVE Received | [email protected] |