Unscored severity · published Oct 28, 2026
CVE-2026-110292
PayPlug for WooCommerce 2.9.0 - 3.1.0 - Unauthenticated Order Key Disclosure and Order Cancellation via payplug_create_intent
New
–
CVSS
–
EPSS
No
On KEV
Description
The PayPlug for WooCommerce (Official) WordPress plugin before 3.1.1 does not verify that the requester owns the WooCommerce order named in a payment request, allowing unauthenticated users to disclose another customer's order key and cancel their unpaid guest order.
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PF
PayPlug for WooCommerce (Official) ·
2.9.0 before 3.1.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-110292
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-110292
exploit
https://wpscan.com/vulnerability/91444324-4332-489e-9e97-f371d866c20c/
More from PayPlug for WooCommerce (Official)
–
CVE-2026-113813
PayPlug for WooCommerce 2.8.0 - 3.1.0 - Unauthenticated Arbitrary Order Deletion, Modification and Disclosure