CVE-2026-12973 PayPlus CVE debrief

Who should care

Users of the PayPlus Payment Gateway WordPress plugin, especially those with WooCommerce orders, should be aware of this vulnerability and take steps to protect their sites. Affected operators, platforms, vulnerability-management, and security teams should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.

Technical summary

The PayPlus Payment Gateway WordPress plugin before 8.2.2 does not perform authorization or order-ownership validation in one of its AJAX actions available to unauthenticated users. This allows them to disclose the secret order key of arbitrary WooCommerce orders and, under some configurations, to modify order statuses. The vulnerability has a high impact on users of the PayPlus Payment Gateway WordPress plugin, especially those with WooCommerce orders.

Defensive priority

High priority for users of the PayPlus Payment Gateway WordPress plugin, especially those with WooCommerce orders.

Recommended defensive actions

• Update the PayPlus Payment Gateway WordPress plugin to version 8.2.2 or later
• Review and restrict access to AJAX actions in the plugin
• Monitor for suspicious activity related to WooCommerce orders
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The evidence for this vulnerability is limited. Verify the plugin version and configuration. Monitor for suspicious activity related to WooCommerce orders. Check relevant monitoring, detection, and logs for exposed assets that need extra review. Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Official resources