Payplus Payment Gateway
Approved changes feed: RSS · Atom
cpe:2.3:a:unknown:payplus_payment_gateway:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Unknown (668ca391-a6cc-5e33-879b-83885214de33) |
|---|---|
| Product | Payplus Payment Gateway (fcae71ca-8d47-550c-a0df-fcb67102be2a) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-12973 |
vulnerable | 2026-07-29 00:23:32.723190 |
PayPlus Payment Gateway < 8.2.2 - Unauthenticated Order Key Disclosure and Order Status Modification
The PayPlus Payment Gateway WordPress plugin before 8.2.2 does not perform authorization or order-ownership validation in one of its AJAX actions available to unauthenticated users, allowing them to disclose the secret order key of arbitrary WooCommerce orders and, under some configurations, to modify order statuses.
Published: 2026-07-20T06:00:04.376Z
Updated: 2026-07-20T14:59:50.083Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-12972 |
vulnerable | 2026-07-29 00:23:32.722885 |
PayPlus Payment Gateway < 8.2.2 - Unauthenticated Order Payment Metadata Tampering
The PayPlus Payment Gateway WordPress plugin before 8.2.2 does not perform authorization or order-ownership validation in one of its AJAX actions available to unauthenticated users, allowing them to tamper with the payment-related metadata of arbitrary WooCommerce orders.
Published: 2026-07-20T06:00:04.142Z
Updated: 2026-07-20T15:00:38.378Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-6205 |
vulnerable | 2026-06-08 06:58:18.187907 |
PayPlus Payment Gateway < 6.6.9 - Unauthenticated SQLi
The PayPlus Payment Gateway WordPress plugin before 6.6.9 does not properly sanitise and escape a parameter before using it in a SQL statement via a WooCommerce API route available to unauthenticated users, leading to an SQL injection vulnerability.
Published: 2024-07-19T06:00:06.257Z
Updated: 2024-08-01T21:33:05.100Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.