---
id: "CVE-2026-113813"
kind: "vulnerability"
aliases: ["CVE-2026-113813"]
title: "PayPlug WooCommerce plugin lets anyone read, edit and delete orders"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["e-commerce", "package", "payplug", "woocommerce", "wordpress"]
not_affected_if: ["plugin-not-installed", "version-3.1.1-or-later"]
published_at: "2026-10-28T06:16:35+00:00"
first_seen_at: "2026-10-28T06:31:27+00:00"
updated_at: "2026-10-28T06:32:25+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113813", "first_seen_at": "2026-10-28T06:31:27+00:00"}]
---

# PayPlug WooCommerce plugin lets anyone read, edit and delete orders

The PayPlug for WooCommerce WordPress plugin before 3.1.1 exposes unauthenticated AJAX actions that take an order ID and perform no permission or ownership check. An unauthenticated attacker can read, modify or permanently delete any WooCommerce order.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of the PayPlug for WooCommerce (Official) plugin under Plugins in wp-admin, or in `wp-content/plugins/` (the plugin header `Version:` line).
- Look for the unauthenticated AJAX hooks of the plugin under `wp-admin/admin-ajax.php` (`wp_ajax_nopriv_` registrations in the plugin code).

## Fix

- Update PayPlug for WooCommerce (Official) to `3.1.1` or later.
- If you cannot update right away, deactivate the plugin and review WooCommerce orders for unexpected changes or deletions.

## Timeline

- 2026-10-28T06:31:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-113813

## From the sources

The PayPlug for WooCommerce (Official) WordPress plugin before 3.1.1 does not perform any capability or ownership check on a set of unauthenticated AJAX actions that operate on a caller-supplied order identifier, allowing unauthenticated attackers to modify, read the contents of, and permanently delete arbitrary WooCommerce orders.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_