CVE-2026-13692 — PayU CommercePro < 3.9.0 - Unauthenticated Order Tampering
The PayU CommercePro Plugin WordPress plugin before 3.9.0 does not verify the payment-gateway signature before applying order modifications, allowing unauthenticated attackers t…
Published: 2026-07-29 · CVSS: 5.3 · CVSS 3.1
The PayU CommercePro Plugin WordPress plugin before 3.9.0 does not verify the payment-gateway signature before applying order modifications, allowing unauthenticated attackers to tamper with the totals, shipping and metadata of arbitrary WooCommerce orders.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7