CVE-2026-12972

MediumCVSS 5.3/10Last modified Jul 21, 2026

Description

The PayPlus Payment Gateway WordPress plugin before 8.2.2 does not perform authorization or order-ownership validation in one of its AJAX actions available to unauthenticated users, allowing them to tamper with the payment-related metadata of arbitrary WooCommerce orders.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-284

Affected software

No affected versions have been published.

Timeline

Published
Jul 20, 2026
Last modified
Jul 21, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-129736.5The PayPlus Payment Gateway WordPress plugin before 8.2.2 does not perform authorization or order-ownership validation in one of its AJAX acCVE-2026-129747.9A Security Policy Bypass vulnerability exists in Forcepoint Security Engine (NGFW). This issue affects Forcepoint Security Engine (NGFW): CVE-2026-129758.5A flaw was found in Apicurio Registry. The ContentTypeUtil.isParsableXml() method creates a SAXParserFactory without enabling secure processCVE-2026-129766.5The LearnPress WordPress plugin before 4.4.4 does not verify that a user is enrolled in a course before processing AI-assistant requests agCVE-2026-129787.1The FunnelKit WordPress plugin before 3.15.0.6 does not escape a user-supplied parameter before reflecting it into the HTML response of oneCVE-2026-129795.5The FunnelKit WordPress plugin before 3.15.0.6 does not validate a user-supplied path before deleting a file during a template-import operaCVE-2026-12984.3The Easy Replace Image plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.5.2. This is due CVE-2026-129806.8The Post Snippets WordPress plugin through 4.2.4 does not properly escape variable values substituted into snippets before outputting them,CVE-2026-129817.5The CAFEHAUS API WordPress plugin through 1.0.0 does not have any authentication or authorisation when updating user passwords, allowing unaCVE-2026-129826.1The Document Gallery WordPress plugin before 5.1.1 does not properly sanitise and escape user input before reflecting it back in the responsCVE-2026-129838.6The Dinatur WordPress plugin through 1.18 does not sanitize and escape user input before using it in a SQL query, allowing unauthenticated uCVE-2026-129848.2Insufficiently Protected Credentials vulnerability in Zyxel Networks WAH7601 allows Retrieve Embedded Sensitive Data. This issue affects WA