CVE-2026-12973: PayPlus Gateway Info Disclosure Flaw

CVE-2026-12973 Overview

CVE-2026-12973 is a missing authorization vulnerability [CWE-862] in the PayPlus Payment Gateway WordPress plugin versions before 8.2.2. The plugin exposes an AJAX action to unauthenticated users without performing authorization or order-ownership validation. Attackers can disclose the secret order key of arbitrary WooCommerce orders. Under some configurations, they can also modify order statuses. The flaw is remotely exploitable over the network without authentication or user interaction.

Critical Impact
Unauthenticated attackers can retrieve secret order keys for arbitrary WooCommerce orders and, in certain configurations, tamper with order status values on affected stores.

Affected Products

PayPlus Payment Gateway WordPress plugin versions before 8.2.2
WooCommerce stores integrating the vulnerable PayPlus plugin
WordPress sites exposing the plugin's AJAX endpoint to unauthenticated visitors

Discovery Timeline

2026-07-20 - CVE-2026-12973 published to NVD
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2026-12973

Vulnerability Analysis

The PayPlus Payment Gateway plugin registers an AJAX action reachable through the standard WordPress admin-ajax.php handler. The action is hooked into both authenticated and unauthenticated request handlers, making it callable by any network visitor. The handler does not verify the caller's identity, nor does it confirm that the caller owns the requested WooCommerce order.

An attacker can iterate WooCommerce order identifiers and request order data through the vulnerable endpoint. The response leaks the order's secret order key, a token WooCommerce uses to authorize order-related actions such as viewing the order details page or triggering order status transitions. In deployments where the endpoint also processes status parameters, the same missing check permits attackers to change order statuses without owning the order.

Root Cause

The root cause is a missing authorization check on a privileged AJAX action registered for unauthenticated users [CWE-862]. The handler executes order lookups and, in some flows, status updates without validating the current user's capabilities or verifying that a supplied nonce ties the request to the target order.

Attack Vector

Exploitation requires only network access to the WordPress site. An attacker sends crafted POST requests to wp-admin/admin-ajax.php referencing the vulnerable PayPlus action name and iterating order identifiers. See the WPScan Vulnerability Advisory for endpoint specifics.

No authentication, session, or user interaction is required. Attackers can automate enumeration of order IDs to harvest secret keys across the entire order table. Leaked keys enable follow-on actions such as accessing order detail URLs that use the key as an authorization token.

Detection Methods for CVE-2026-12973

Indicators of Compromise

Repeated POST requests to /wp-admin/admin-ajax.php referencing the PayPlus plugin action with sequential or randomized order_id values from a single source.
WooCommerce order status changes with no corresponding administrator or customer session activity in the audit log.
Access log entries showing admin-ajax.php requests from unauthenticated clients returning response bodies containing order_key values.

Detection Strategies

Alert on high-volume unauthenticated requests to admin-ajax.php targeting PayPlus action names within short time windows.
Correlate WooCommerce order status transitions with the acting user; flag transitions attributed to unauthenticated or guest sessions.
Deploy web application firewall rules that inspect AJAX request bodies for PayPlus action identifiers combined with numeric order enumeration patterns.

Monitoring Recommendations

Enable WordPress and WooCommerce activity logging to capture order-key access and status change events.
Monitor outbound response sizes on admin-ajax.php to detect bulk data disclosure.
Track anomalous 4xx/2xx response ratios per source IP against the AJAX endpoint to identify scanning activity.

How to Mitigate CVE-2026-12973

Immediate Actions Required

Update the PayPlus Payment Gateway plugin to version 8.2.2 or later on all WordPress sites.
Audit WooCommerce order logs for unauthorized status changes since the plugin was installed.
Rotate or invalidate any exposed order keys where feasible, and notify affected customers if order data was accessed.

Patch Information

The vendor addressed the missing authorization flaw in PayPlus Payment Gateway version 8.2.2. Site administrators should upgrade through the WordPress plugin dashboard or by deploying the updated plugin package. Refer to the WPScan Vulnerability Advisory for confirmation of the fixed version.

Workarounds

Restrict access to wp-admin/admin-ajax.php from untrusted networks using web application firewall or reverse proxy rules until the patch is applied.
Temporarily disable the PayPlus Payment Gateway plugin if a delayed upgrade is unavoidable and switch to an alternative payment method.
Add server-level filters that block AJAX requests referencing the vulnerable PayPlus action name from unauthenticated sources.

bash

# Configuration example: block unauthenticated PayPlus AJAX action at the web server
# nginx example - reject requests to the vulnerable action from unauthenticated clients
location = /wp-admin/admin-ajax.php {
    if ($arg_action ~* "payplus") {
        return 403;
    }
    include fastcgi_params;
    fastcgi_pass php_upstream;
}