{"id":"CVE-2026-113813","aliases":["EUVD-2026-111728","GHSA-pp3q-4jh2-gvr2"],"status":"published","title":"PayPlug for WooCommerce 2.8.0 - 3.1.0 - Unauthenticated Arbitrary Order Deletion, Modification and Disclosure","description":"The PayPlug for WooCommerce (Official) WordPress plugin before 3.1.1 does not perform any capability or ownership check on a set of unauthenticated AJAX actions that operate on a caller-supplied order identifier, allowing unauthenticated attackers to modify, read the contents of, and permanently delete arbitrary WooCommerce orders.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.00209,"percentile":0.11192,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-862"],"published":"2026-10-28T06:00:26Z","modified":"2026-10-28T18:33:03Z","products":[{"vendor":"payplug","product":"payplug for woocommerce (official)"},{"vendor":"unknown","product":"payplug for woocommerce (official)"}],"references":[{"url":"https://wpscan.com/vulnerability/6decb385-7cc9-42d7-a079-0a96d1f697fc/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113813"},{"url":"https://wpscan.com/vulnerability/6decb385-7cc9-42d7-a079-0a96d1f697fc"},{"url":"https://github.com/advisories/GHSA-pp3q-4jh2-gvr2"}],"sources":{"cve":[{"id":"CVE-2026-113813","title":"PayPlug for WooCommerce 2.8.0 - 3.1.0 - Unauthenticated Arbitrary Order Deletion, Modification and Disclosure","description":"The PayPlug for WooCommerce (Official) WordPress plugin before 3.1.1 does not perform any capability or ownership check on a set of unauthenticated AJAX actions that operate on a caller-supplied order identifier, allowing unauthenticated attackers to modify, read the contents of, and permanently delete arbitrary WooCommerce orders.","status":"published","published":"2026-10-28T06:00:26.467Z","modified":"2026-10-28T17:58:04.601Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T13:44:29.519518Z"}],"euvd":[{"id":"EUVD-2026-111728","description":"The PayPlug for WooCommerce (Official) WordPress plugin before 3.1.1 does not perform any capability or ownership check on a set of unauthenticated AJAX actions that operate on a caller-supplied order identifier, allowing unauthenticated attackers to modify, read the contents of, and permanently delete arbitrary WooCommerce orders.","status":"published","published":"2026-10-28T06:00:26Z","modified":"2026-10-28T17:58:04Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:59:19.529238Z"}],"ghsa":[{"id":"GHSA-pp3q-4jh2-gvr2","title":"The PayPlug for WooCommerce (Official) WordPress plugin before 3.1.1 does not perform any...","description":"The PayPlug for WooCommerce (Official) WordPress plugin before 3.1.1 does not perform any capability or ownership check on a set of unauthenticated AJAX actions that operate on a caller-supplied order identifier, allowing unauthenticated attackers to modify, read the contents of, and permanently delete arbitrary WooCommerce orders.","status":"published","published":"2026-10-28T06:30:28Z","modified":"2026-10-28T18:33:03Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T15:14:36.375319Z"}],"nvd":[{"id":"CVE-2026-113813","description":"The PayPlug for WooCommerce (Official) WordPress plugin before 3.1.1 does not perform any capability or ownership check on a set of unauthenticated AJAX actions that operate on a caller-supplied order identifier, allowing unauthenticated attackers to modify, read the contents of, and permanently delete arbitrary WooCommerce orders.","status":"published","published":"2026-10-28T06:16:35.503Z","modified":"2026-10-28T18:17:09.98Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:13:04.037468Z"}]}}