Medium severity6.5NVD Advisory· Published Jul 20, 2026· Updated Jul 21, 2026

CVE-2026-12973

Description

The PayPlus Payment Gateway WordPress plugin before 8.2.2 does not perform authorization or order-ownership validation in one of its AJAX actions available to unauthenticated users, allowing them to disclose the secret order key of arbitrary WooCommerce orders and, under some configurations, to modify order statuses.

Affected products

WordPress/Payplus Payment Gatewayllm-fuzzy2 versions
<8.2.2+ 1 more
- (no CPE)range: <8.2.2
- (no CPE)range: <8.2.2
Package: https://wordpress.org/plugins/payplus-payment-gateway

Patches

Vulnerability mechanics

References

wpscan.com/vulnerability/385bee73-f9e5-425e-aa4c-3ff9274f8e00/nvd

News mentions

No linked articles in our index yet.

cvss	0.423
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000