CVE-2026-113813: PayPlug for WooCommerce 2.8.0 - 3.1.0 - Unauthenticated Arbitrary Order Deletion, Modification and Disclosure

Q: Who can exploit this issue?

Unauthenticated attackers can exploit the affected AJAX actions. No login, capability, or ownership check is performed for the vulnerable actions.

Q: What can an attacker do with a valid order identifier?

An attacker can read the contents of an arbitrary WooCommerce order, modify it, or permanently delete it. The affected actions operate on an order identifier supplied by the caller.

Q: Which plugin versions are affected?

PayPlug for WooCommerce (Official) versions 2.8.0 through 3.1.0 are affected. Versions before 3.1.1 are vulnerable according to the provided information.

Q: How can I determine whether my site is affected?

Check whether PayPlug for WooCommerce (Official) is installed and running a version from 2.8.0 through 3.1.0. Sites using a version before 3.1.1 should be treated as affected.

Published Oct 28, 2026

Updated

The PayPlug for WooCommerce (Official) WordPress plugin before 3.1.1 does not perform any capability or ownership check on a set of unauthenticated AJAX actions that operate on a caller-supplied order identifier, allowing unauthenticated attackers to modify, read the contents of, and permanently delete arbitrary WooCommerce orders.

Affected Software

1 affected component

PayPlug PayPlug for WooCommerce>=2.8.0<=3.1.0

Event History

Oct 28, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

Unauthenticated attackers can exploit the affected AJAX actions. No login, capability, or ownership check is performed for the vulnerable actions.

What can an attacker do with a valid order identifier?

An attacker can read the contents of an arbitrary WooCommerce order, modify it, or permanently delete it. The affected actions operate on an order identifier supplied by the caller.

Which plugin versions are affected?

PayPlug for WooCommerce (Official) versions 2.8.0 through 3.1.0 are affected. Versions before 3.1.1 are vulnerable according to the provided information.

How can I determine whether my site is affected?

Check whether PayPlug for WooCommerce (Official) is installed and running a version from 2.8.0 through 3.1.0. Sites using a version before 3.1.1 should be treated as affected.

CVE-2026-113813: PayPlug for WooCommerce 2.8.0 - 3.1.0 - Unauthenticated Arbitrary Order Deletion, Modification and Disclosure

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What can an attacker do with a valid order identifier?

Which plugin versions are affected?

How can I determine whether my site is affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What can an attacker do with a valid order identifier?

Which plugin versions are affected?

How can I determine whether my site is affected?