Live › vulnerability › CVE-2026-110292
Go to dashboardThe PayPlug for WooCommerce WordPress plugin before 3.1.1 does not check that a payment request comes from the owner of the order. An unauthenticated visitor can read another customer's order key and cancel that customer's unpaid guest order.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 06:31 UTC. All times on this page are UTC.
WooCommerce stores that use the PayPlug for WooCommerce (Official) plugin and accept guest checkout with unpaid orders are exposed. Stores without this plugin, or running a version at or above 3.1.1, are not affected.
No product ranges from the sources yet.
3.1.1.3.1.1 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The PayPlug for WooCommerce (Official) WordPress plugin before 3.1.1 does not verify that the requester owns the WooCommerce order named in a payment request, allowing unauthenticated users to disclose another customer's order key and cancel their unpaid guest order.
This page as .md · .json · in your agent: get_signal("CVE-2026-110292")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.