Unscored severity · published Oct 28, 2026
CVE-2026-113813
PayPlug for WooCommerce 2.8.0 - 3.1.0 - Unauthenticated Arbitrary Order Deletion, Modification and Disclosure
New
–
CVSS
–
EPSS
No
On KEV
Description
The PayPlug for WooCommerce (Official) WordPress plugin before 3.1.1 does not perform any capability or ownership check on a set of unauthenticated AJAX actions that operate on a caller-supplied order identifier, allowing unauthenticated attackers to modify, read the contents of, and permanently delete arbitrary WooCommerce orders.
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PF
PayPlug for WooCommerce (Official) ·
2.8.0 before 3.1.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-113813
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-113813
exploit
https://wpscan.com/vulnerability/6decb385-7cc9-42d7-a079-0a96d1f697fc/
More from PayPlug for WooCommerce (Official)
–
CVE-2026-110292
PayPlug for WooCommerce 2.9.0 - 3.1.0 - Unauthenticated Order Key Disclosure and Order Cancellation via payplug_create_intent