We’re taking on a small number of new builds and rebuilds this quarter. Book a call to see if your project is a fit.

CVE CVE-2026-12973

CVE-2026-12973

WordPress

Severity: MEDIUM
CVSS: 6.5CVSS
Published: 2026-07-20
Last modified: 2026-07-20
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CWE: CWE-862

Description

The PayPlus Payment Gateway WordPress plugin before 8.2.2 does not perform authorization or order-ownership validation in one of its AJAX actions available to unauthenticated users, allowing them to disclose the secret order key of arbitrary WooCommerce orders and, under some configurations, to modify order statuses.

References

https://wpscan.com/vulnerability/385bee73-f9e5-425e-aa4c-3ff9274f8e00/

Summary

Description

References