{"id":"CVE-2026-113813","aliases":[],"title":"PayPlug for WooCommerce 2.8.0 - 3.1.0 - Unauthenticated Arbitrary Order Deletion, Modification and Disclosure","titleSource":"WPScan","descriptionSource":"WPScan","products":[{"vendor":"Unknown","name":"PayPlug for WooCommerce (Official)","platforms":[],"versions":[{"version":"2.8.0","status":"affected","lessThan":"3.1.1","versionType":"semver"}],"defaultStatus":"unaffected","source":"WPScan","url":"https://www.cve.org/CVERecord?id=CVE-2026-113813"}],"remediation":[],"description":"The PayPlug for WooCommerce (Official) WordPress plugin before 3.1.1 does not perform any capability or ownership check on a set of unauthenticated AJAX actions that operate on a caller-supplied order identifier, allowing unauthenticated attackers to modify, read the contents of, and permanently delete arbitrary WooCommerce orders.","severity":"unknown","score":null,"published":"2026-10-28T06:00:26.467Z","modified":"2026-10-28T17:58:04.601Z","withdrawn":false,"knownExploited":false,"affected":[],"references":["https://wpscan.com/vulnerability/6decb385-7cc9-42d7-a079-0a96d1f697fc/"],"sources":[{"name":"CVE","id":"CVE-2026-113813","modified":"2026-10-28T17:58:04.601Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-113813"}],"assessments":[],"sourceAffected":[],"kev":{"status":"not-listed","checkedAt":"2026-10-28T20:15:32.897Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-10-28T10:25:32.609Z","attemptedAt":"2026-10-28T10:25:32.609Z"},{"source":"GHSA","status":"available","checkedAt":"2026-10-28T10:25:32.609Z","attemptedAt":"2026-10-28T10:25:32.609Z"},{"source":"EUVD","status":"available","checkedAt":"2026-10-28T10:25:32.609Z","attemptedAt":"2026-10-28T10:25:32.609Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-10-28T10:25:32.609Z","attemptedAt":"2026-10-28T10:25:32.609Z"}],"evidence":[{"source":"NVD","id":"CVE-2026-113813","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113813","modified":"2026-10-28T06:16:35.503","checkedAt":"2026-10-28T10:25:32.609Z"},{"source":"ENISA EUVD","id":"EUVD-2026-111728","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-111728","modified":"Oct 28, 2026, 6:00:26 AM","checkedAt":"2026-10-28T10:25:32.609Z"},{"source":"GitHub Advisory Database","id":"GHSA-pp3q-4jh2-gvr2","url":"https://github.com/advisories/GHSA-pp3q-4jh2-gvr2","modified":"2026-10-28T06:30:33Z","checkedAt":"2026-10-28T10:25:32.609Z"}]}