CVE-2026-110292: PayPlug for WooCommerce 2.9.0 - 3.1.0 - Unauthenticated Order Key Disclosure and Order Cancellation via payplug_create_intent

Q: Which sites and orders are exposed?

Sites using the PayPlug for WooCommerce (Official) WordPress plugin before version 3.1.1 are affected. The issue applies to unpaid guest orders.

Q: What does an attacker need to exploit this?

No authentication is required. The attacker needs to name a WooCommerce order in a payment request; the plugin does not verify that the requester owns that order.

Q: What could an attacker do with a successful request?

An attacker can disclose another customer's order key and cancel that customer's unpaid guest order.

Q: How can I determine whether my site is affected?

Check the installed version of PayPlug for WooCommerce (Official). Versions before 3.1.1 are affected.

Published Oct 28, 2026

Updated

The PayPlug for WooCommerce (Official) WordPress plugin before 3.1.1 does not verify that the requester owns the WooCommerce order named in a payment request, allowing unauthenticated users to disclose another customer's order key and cancel their unpaid guest order.

Affected Software

1 affected component

PayPlug PayPlug for WooCommerce<3.1.1

Event History

Oct 28, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Which sites and orders are exposed?

Sites using the PayPlug for WooCommerce (Official) WordPress plugin before version 3.1.1 are affected. The issue applies to unpaid guest orders.

What does an attacker need to exploit this?

No authentication is required. The attacker needs to name a WooCommerce order in a payment request; the plugin does not verify that the requester owns that order.

What could an attacker do with a successful request?

An attacker can disclose another customer's order key and cancel that customer's unpaid guest order.

How can I determine whether my site is affected?

Check the installed version of PayPlug for WooCommerce (Official). Versions before 3.1.1 are affected.

CVE-2026-110292: PayPlug for WooCommerce 2.9.0 - 3.1.0 - Unauthenticated Order Key Disclosure and Order Cancellation via payplug_create_intent

Affected Software

Event History

Frequently Asked Questions

Which sites and orders are exposed?

What does an attacker need to exploit this?

What could an attacker do with a successful request?

How can I determine whether my site is affected?

Company

Resources

Contact

Frequently Asked Questions

Which sites and orders are exposed?

What does an attacker need to exploit this?

What could an attacker do with a successful request?

How can I determine whether my site is affected?