PT-2026-61530 · WordPress · Payplus Payment Gateway

Kevin · CVE-2026-12973 · Published 2026-07-20 · Updated 2026-07-20

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions PayPlus Payment Gateway WordPress plugin versions prior to 8.2.2

Description An issue exists where the plugin fails to perform authorization or order-ownership validation in an AJAX action accessible to unauthenticated users. This allows an attacker to disclose the secret order key of arbitrary WooCommerce orders and, depending on the configuration, modify order statuses.

Recommendations Update the PayPlus Payment Gateway WordPress plugin to version 8.2.2 or later.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-12973

Affected Products

Payplus Payment Gateway

References · 3

• 🔥 https://wpscan.com/vulnerability/385bee73-f9e5-425e-aa4c-3ff9274f8e00 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-12973 · Security Note
• https://twitter.com/VulmonFeeds/status/2079132985949839452 · Twitter Post