Description
The PayPlug for WooCommerce (Official) WordPress plugin before 3.1.1 does not verify that the requester owns the WooCommerce order named in a payment request, allowing unauthenticated users to disclose another customer's order key and cancel their unpaid guest order.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | PayPlug for WooCommerce (Official) | 2.9.0 – < 3.1.1 | 3.1.1 |
References
- https://wpscan.com/vulnerability/91444324-4332-489e-9e97-f371d866c20c/ exploit vdb-entry technical-description