{"id":"CVE-2026-113813","title":"PayPlug for WooCommerce 2.8.0 - 3.1.0 - Unauthenticated Arbitrary Order Deletion, Modification and Disclosure","summary":"The PayPlug for WooCommerce (Official) WordPress plugin before 3.1.1 does not perform any capability or ownership check on a set of unauthenticated AJAX actions that operate on a caller-supplied order identifier, allowing unauthenticated…","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","cvssSource":"adp","cwe":["CWE-862"],"product":"PayPlug for WooCommerce (Official)","affected":["payplug_for_woocommerce_official >= 2.8.0 < 3.1.1"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-10-28T17:41:27.421648Z"},"published":"2026-10-28","updated":"2026-10-28","sourceUpdated":"2026-10-28T17:58:04.601Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-113813","references":[{"url":"https://wpscan.com/vulnerability/6decb385-7cc9-42d7-a079-0a96d1f697fc/"}],"tags":["cve.org"],"epss":0.00209,"epssPercentile":0.11181,"ingestedAt":"2026-10-28T07:06:27.133Z","slug":"CVE-2026-113813","body":"## Overview\n\nThe PayPlug for WooCommerce (Official) WordPress plugin before 3.1.1 does not perform any capability or ownership check on a set of unauthenticated AJAX actions that operate on a caller-supplied order identifier, allowing unauthenticated attackers to modify, read the contents of, and permanently delete arbitrary WooCommerce orders.\n\n## Affected\n\n- `payplug_for_woocommerce_official >= 2.8.0 < 3.1.1`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":230829,"id":"CVE-2026-113813","ts":1793211386372,"field":"cvss","old":null,"new":"6.5"},{"seq":230828,"id":"CVE-2026-113813","ts":1793211386372,"field":"severity","old":"none","new":"medium"}]}