Live › vulnerability › CVE-2026-113813
Go to dashboardThe PayPlug for WooCommerce WordPress plugin before 3.1.1 exposes unauthenticated AJAX actions that take an order ID and perform no permission or ownership check. An unauthenticated attacker can read, modify or permanently delete any WooCommerce order.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 06:31 UTC. All times on this page are UTC.
Any WooCommerce store running PayPlug for WooCommerce (Official) before 3.1.1 is exposed, because the flaw sits in unauthenticated AJAX endpoints reachable by any visitor. Stores that do not use this plugin, or that run 3.1.1 or later, can skip it.
No product ranges from the sources yet.
wp-content/plugins/ (the plugin header Version: line).wp-admin/admin-ajax.php (wp_ajax_nopriv_ registrations in the plugin code).3.1.1 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The PayPlug for WooCommerce (Official) WordPress plugin before 3.1.1 does not perform any capability or ownership check on a set of unauthenticated AJAX actions that operate on a caller-supplied order identifier, allowing unauthenticated attackers to modify, read the contents of, and permanently delete arbitrary WooCommerce orders.
This page as .md · .json · in your agent: get_signal("CVE-2026-113813")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.