CVE-2026-12972 — PayPlus Payment Gateway < 8.2.2 - Unauthenticated Order Payment Metadata Tampering
The PayPlus Payment Gateway WordPress plugin before 8.2.2 does not perform authorization or order-ownership validation in one of its AJAX actions available to unauthenticated us…
Published: 2026-07-20 · CVSS: 5.3 · CVSS 3.1
The PayPlus Payment Gateway WordPress plugin before 8.2.2 does not perform authorization or order-ownership validation in one of its AJAX actions available to unauthenticated users, allowing them to tamper with the payment-related metadata of arbitrary WooCommerce orders.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7