{"id":"CVE-2026-113813","kind":"vulnerability","aliases":["CVE-2026-113813"],"related":[],"title":"PayPlug WooCommerce plugin lets anyone read, edit and delete orders","description":"The PayPlug for WooCommerce (Official) WordPress plugin before 3.1.1 does not perform any capability or ownership check on a set of unauthenticated AJAX actions that operate on a caller-supplied order identifier, allowing unauthenticated attackers to modify, read the contents of, and permanently delete arbitrary WooCommerce orders.","summary":"The PayPlug for WooCommerce WordPress plugin before 3.1.1 exposes unauthenticated AJAX actions that take an order ID and perform no permission or ownership check. An unauthenticated attacker can read, modify or permanently delete any WooCommerce order.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["e-commerce","package","payplug","woocommerce","wordpress"],"not_affected_if":["plugin-not-installed","version-3.1.1-or-later"],"how_to_check":"- Check the installed version of the PayPlug for WooCommerce (Official) plugin under Plugins in wp-admin, or in `wp-content/plugins/` (the plugin header `Version:` line).\n- Look for the unauthenticated AJAX hooks of the plugin under `wp-admin/admin-ajax.php` (`wp_ajax_nopriv_` registrations in the plugin code).","fix":"- Update PayPlug for WooCommerce (Official) to `3.1.1` or later.\n- If you cannot update right away, deactivate the plugin and review WooCommerce orders for unexpected changes or deletions.","status":"open","published_at":"2026-10-28T06:16:35+00:00","first_seen_at":"2026-10-28T06:31:27+00:00","triaged_at":"2026-10-28T06:32:25+00:00","updated_at":"2026-10-28T06:32:25+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-28T06:32:25Z","model":"claude-haiku-5-5","output":{"fix":"- Update PayPlug for WooCommerce (Official) to `3.1.1` or later.\n- If you cannot update right away, deactivate the plugin and review WooCommerce orders for unexpected changes or deletions.","reach":"internet","title":"PayPlug WooCommerce plugin lets anyone read, edit and delete orders","impact":"high","summary":"The PayPlug for WooCommerce WordPress plugin before 3.1.1 exposes unauthenticated AJAX actions that take an order ID and perform no permission or ownership check. An unauthenticated attacker can read, modify or permanently delete any WooCommerce order.","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","payplug","e-commerce"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker reads, alters or permanently deletes any store order remotely.","analyst_note":"Confirm the affected version range and the exact vulnerable AJAX action names from the NVD entry or the plugin changelog at https://nvd.nist.gov/vuln/detail/CVE-2026-113813.","how_to_check":"- Check the installed version of the PayPlug for WooCommerce (Official) plugin under Plugins in wp-admin, or in `wp-content/plugins/` (the plugin header `Version:` line).\n- Look for the unauthenticated AJAX hooks of the plugin under `wp-admin/admin-ajax.php` (`wp_ajax_nopriv_` registrations in the plugin code).","needs_analyst":true,"not_affected_if":["plugin-not-installed","version-3.1.1-or-later"],"who_is_affected":"Any WooCommerce store running PayPlug for WooCommerce (Official) before 3.1.1 is exposed, because the flaw sits in unauthenticated AJAX endpoints reachable by any visitor. Stores that do not use this plugin, or that run 3.1.1 or later, can skip it.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000689,"input_tokens":3334,"output_tokens":712,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-113813':13A,16A '-2026':12A,15A '3.1.1':31B,68C 'action':35B,83C 'ajax':34B,82C 'allow':93C 'anyon':5A 'arbitrari':105C 'attack':50B,95C 'caller':89C 'caller-suppli':88C 'capabl':73C 'check':47B,76C 'commerc':19B 'content':100C 'cve':11A,14A 'delet':9A,56B,104C 'e':18B 'e-commerc':17B 'edit':7A 'expos':32B 'id':40B 'identifi':92C 'let':4A 'modifi':53B,97C 'offici':64C 'oper':85C 'order':10A,39B,59B,91C,107C 'ownership':46B,75C 'packag':20B 'payplug':1A,21B,25B,61C 'perform':42B,71C 'perman':55B,103C 'permiss':44B 'plugin':3A,29B,66C 'read':6A,52B,98C 'set':79C 'suppli':90C 'take':37B 'unauthent':33B,49B,81C,94C 'woocommerc':2A,22B,27B,58B,63C,106C 'wordpress':23B,28B,65C","nicknames":[],"mitigations":[],"who_affected":"Any WooCommerce store running PayPlug for WooCommerce (Official) before 3.1.1 is exposed, because the flaw sits in unauthenticated AJAX endpoints reachable by any visitor. Stores that do not use this plugin, or that run 3.1.1 or later, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T06:16:35+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113813","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113813","severity":null,"published_at":"2026-10-28T06:16:35+00:00","modified_at":"2026-10-28T06:16:35+00:00","first_seen_at":"2026-10-28T06:31:27+00:00","fetched_at":"2026-10-28T06:31:27+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}