CVE-2026-93620: WordPress PayPlus Payment Gateway plugin <= 8.2.5 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in PayPlus Payment Gateway <= 8.2.5 versions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress PayPlus Payment Gateway Pluginto a version that resolves this vulnerability.Fixed in 8.2.6
Event History
Frequently Asked Questions
Who can exploit this issue?
The vulnerability is unauthenticated, so an attacker does not need a WordPress account or other prior privileges to exploit it. The supplied vector also indicates network-based exploitation with low attack complexity and no user interaction.
Which plugin versions are affected?
PayPlus Payment Gateway versions 8.2.5 and earlier are identified as affected. The provided data does not state which version contains a fix.
What security impact is indicated?
The vulnerability is rated medium severity with a 6.5 CVSS score. It can result in limited confidentiality and integrity impact, while no availability impact is indicated.