{"id":"CVE-2026-110292","aliases":[],"title":"PayPlug for WooCommerce 2.9.0 - 3.1.0 - Unauthenticated Order Key Disclosure and Order Cancellation via payplug_create_intent","titleSource":"WPScan","descriptionSource":"WPScan","products":[{"vendor":"Unknown","name":"PayPlug for WooCommerce (Official)","platforms":[],"versions":[{"version":"2.9.0","status":"affected","lessThan":"3.1.1","versionType":"semver"}],"defaultStatus":"unaffected","source":"WPScan","url":"https://www.cve.org/CVERecord?id=CVE-2026-110292"}],"remediation":[],"description":"The PayPlug for WooCommerce (Official) WordPress plugin before 3.1.1 does not verify that the requester owns the WooCommerce order named in a payment request, allowing unauthenticated users to disclose another customer's order key and cancel their unpaid guest order.","severity":"unknown","score":null,"published":"2026-10-28T06:00:22.829Z","modified":"2026-10-28T17:58:07.648Z","withdrawn":false,"knownExploited":false,"affected":[],"references":["https://wpscan.com/vulnerability/91444324-4332-489e-9e97-f371d866c20c/"],"sources":[{"name":"CVE","id":"CVE-2026-110292","modified":"2026-10-28T17:58:07.648Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-110292"}],"assessments":[],"sourceAffected":[],"kev":{"status":"not-listed","checkedAt":"2026-10-29T04:10:31.984Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[]}