WordPress Plugin Vulnerability in PayU CommercePro Affects WooCommerce Order Integrity
CVE-2026-13692

Currently unrated

Key Information:

Vendor

WordPress
Status
Payu Commercepro Plugin
Vendor
CVE Published:
29 July 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-13692?

The PayU CommercePro Plugin for WordPress, specifically versions up to 3.8.9, contains a significant security oversight where it fails to validate payment-gateway signatures prior to executing modifications on orders. This allows unverified attackers to manipulate critical components of WooCommerce orders, including totals, shipping details, and metadata. This vulnerability poses a serious risk to e-commerce integrity, enabling unauthorized alterations that could potentially lead to financial loss and compromised transaction security.

Affected Version(s)

PayU CommercePro Plugin 0 <= 3.8.9

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-13692 - Proof of Concept

References

https://wpscan.com/vulnerability/e2dc15c7-2210-4be8-b7f3-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

J4ck13Ch4n
WPScan
.