Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: PayPlug for WooCommerce (Official) 3.1.1 Clear all filters
TI-2026-81713 CVE-2026-113813 · GHSA-pp3q-4jh2-gvr2

Missing authorization in PayPlug for WooCommerce lets attackers delete orders

Priority LOW 34

The PayPlug for WooCommerce (Official) WordPress plugin before 3.1.1 does not perform any capability or ownership check on a set of unauthenticated AJAX actions that operate on a caller-supplied order identifier, allowin…

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00209 Published 2026-10-28 Fixed in 3.1.1 CWE-862
TI-2026-81694 CVE-2026-110292 · GHSA-p42q-6x3c-7prr

PayPlug for WooCommerce Unauthenticated Order Key Disclosure and Cancellation

Priority LOW 34

The PayPlug for WooCommerce (Official) WordPress plugin before 3.1.1 does not verify that the requester owns the WooCommerce order named in a payment request, allowing unauthenticated users to disclose another customer's…

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00223 Published 2026-10-28 Fixed in 3.1.1 CWE-200