Authentication Bypass Vulnerability in PayPlug for WooCommerce Plugin by WordPress
CVE-2026-110292
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 28 October 2026
Badges
What is CVE-2026-110292?
The PayPlug for WooCommerce WordPress plugin prior to version 3.1.1 contains a significant security flaw that allows unauthenticated users to gain access to sensitive information concerning customer orders. The vulnerability arises because the plugin does not adequately verify the ownership of a WooCommerce order during payment requests. This oversight enables malicious actors to potentially view another customer's order key and to cancel unpaid guest orders, posing a risk to customer privacy and data integrity.
Affected Version(s)
PayPlug for WooCommerce (Official) 2.9.0 < 3.1.1
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.