CVE-2026-12973mediumCWE-862

CVE-2026-12973: medium-severity vulnerability in PayPlus Payment Gateway

PayPlus Payment Gateway < 8.2.2 - Unauthenticated Order Key Disclosure and Order Status Modification

Published

Follow this CVE+ Monitor PayPlus Payment Gateway

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

33Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 6.5epss 0.3%
The PayPlus Payment Gateway WordPress plugin before 8.2.2 does not perform authorization or order-ownership validation in one of its AJAX actions available to unauthenticated users, allowing them to disclose the secret order key of arbitrary WooCommerce orders and, under some configurations, to modify order statuses.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Affected products
Unknown · PayPlus Payment Gateway
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — PayPlus Payment Gateway

In the same product, most dangerous first.

CVE-2024-6205HIGHPayPlus Payment Gateway < 6.6.9 - Unauthenticated SQLiEPSS 4.1%CVE-2026-12972MEDIUMPayPlus Payment Gateway < 8.2.2 - Unauthenticated Order Payment Metadata TamperingEPSS 0.3%