CVE-2026-110292 in PayPlug for WooCommerce Plugin
Summary
by MITRE • 10/28/2026
The PayPlug for WooCommerce (Official) WordPress plugin before 3.1.1 does not verify that the requester owns the WooCommerce order named in a payment request, allowing unauthenticated users to disclose another customer's order key and cancel their unpaid guest order.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/28/2026
The vulnerability identified in versions of the PayPlug for WooCommerce plugin prior to release 3.1.1 represents a critical failure in access control mechanisms within the WordPress ecosystem. This flaw stems from an insufficient verification process during the handling of payment-related API requests, specifically those intended to cancel unpaid guest orders or retrieve order details. The core technical deficiency lies in the application's logic, which accepts identifiers for WooCommerce orders without validating that the authenticated session or request originator is the legitimate owner of said order. In a standard e-commerce workflow using WordPress and WooCommerce, sensitive operations such as retrieving an order key or cancelling an unpaid transaction should be strictly bound to the user account associated with that specific purchase. However, in this vulnerable implementation, the server-side processing does not cross-reference the request parameters against the session data or database records of the requesting entity. This architectural oversight allows any unauthenticated actor on the internet to interact directly with the plugin's endpoints by supplying arbitrary order identifiers obtained through enumeration or other means.
From a technical perspective, this vulnerability is classified under CWE-284, which describes Improper Access Control, and more specifically aligns with CWE-639 regarding Authorization Bypass Through User-Controlled Key. The attacker can exploit this flaw by crafting HTTP requests that target the specific API endpoints exposed by the PayPlug plugin. By manipulating parameters such as order IDs or keys, an adversary can trigger actions intended only for verified customers. For instance, if a user's guest order ID is known, which is often visible in URLs or email confirmations sent to legitimate buyers, the attacker can send a cancellation request that successfully terminates the transaction from the merchant's perspective without possessing valid credentials. Similarly, requests designed to fetch sensitive data like the WooCommerce order key will return this information because the backend fails to enforce ownership constraints. This behavior effectively bypasses the intended security boundaries established by the WordPress authentication framework and WooCommerce's native permission models.
The operational impact of this vulnerability is significant for both merchants and their customers. For end-users, the primary risk involves privacy violations and potential financial disruption. The disclosure of an order key can expose sensitive transaction details that are typically protected from public view, potentially facilitating further social engineering attacks or unauthorized access if other systems rely on these keys for verification. More immediately, the ability to cancel unpaid guest orders allows malicious actors to disrupt legitimate business operations. A customer might find their pending purchase unexpectedly cancelled by a third party, leading to confusion, loss of goods, and potential disputes with merchants who may not realize the cancellation was unauthorized. This undermines trust in the payment processing infrastructure and can result in lost revenue for businesses that rely on automated order management systems integrated with PayPlug.
To mitigate this vulnerability, immediate action is required by administrators running affected versions of the plugin. The primary remediation step is to upgrade the PayPlug for WooCommerce plugin to version 3.1.1 or later, where these access control checks have been implemented and validated. Until an update can be applied, site owners should consider implementing additional server-side rules via a Web Application Firewall (WAF) to restrict direct access to sensitive API endpoints unless they originate from trusted internal sources or include valid session tokens that are rigorously verified against order ownership records. Furthermore, developers integrating similar payment gateways into WordPress environments must adhere to the principle of least privilege and ensure that every state-changing operation verifies user identity and resource ownership before execution. This aligns with industry standards such as OWASP Top 10, specifically addressing Broken Access Control, which remains one of the most prevalent and dangerous web application security risks. Regular auditing of plugin code for proper authorization logic is essential to prevent similar flaws in future updates or custom integrations.