CVE-2026-42637: WordPress PayPlug for WooCommerce (Official) plugin <= 3.1.0 - Settings Change vulnerability
Published Oct 6, 2026
·Updated
Unauthenticated Settings Change in PayPlug for WooCommerce (Official) <= 3.1.0 versions.
Affected Software
1 affected component
PayPlug PayPlug for WooCommerce (Official)<=3.1.0
Event History
Oct 6, 2026
CVE Published
via MITRE·08:35 AM
Data Sourced
via MITRE·08:35 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·09:17 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this issue?
The vulnerability is unauthenticated, so an attacker does not need a WordPress account or other prior privileges to attempt exploitation over the network.
2
What versions are affected?
PayPlug for WooCommerce (Official) versions up to and including 3.1.0 are identified as affected.
3
What is the potential impact?
Successful exploitation can change plugin settings. The supplied severity vector indicates integrity and availability impacts, with no stated confidentiality impact.