Unauthenticated Order Tampering in WooCommerce Plugin by Direct Payments
CVE-2026-12966
Currently unrated
What is CVE-2026-12966?
The Direct Payments for WooCommerce plugin for WordPress prior to version 2.5.3 is susceptible to a serious vulnerability where unauthenticated users can manipulate WooCommerce order statuses through insecure AJAX handlers. This flaw allows attackers to change order states to 'payment sent', overwrite payment method labels, and attach fake payment proof files without verification, potentially leading to significant financial discrepancies and undermining trust for online merchants and their customers.
Affected Version(s)
Direct Payments for WooCommerce 0 < 2.5.3
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.