Unrated severityNVD Advisory· Published Jul 20, 2026· Updated Jul 20, 2026

PayPlus Payment Gateway < 8.2.2 - Unauthenticated Order Payment Metadata Tampering

CVE-2026-12972

Description

The PayPlus Payment Gateway WordPress plugin before 8.2.2 does not perform authorization or order-ownership validation in one of its AJAX actions available to unauthenticated users, allowing them to tamper with the payment-related metadata of arbitrary WooCommerce orders.

Affected products

WordPress/Payplus Payment Gatewayinferred2 versions
<8.2.2+ 1 more
- (no CPE)range: <8.2.2
- (no CPE)range: <8.2.2
Package: https://wordpress.org/plugins/payplus-payment-gateway

Patches

Vulnerability mechanics

References

wpscan.com/vulnerability/dcd091d3-f830-4675-a3d5-926f4aa5a7a5/mitreexploitvdb-entrytechnical-description

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000