PayPlug for WooCommerce (Official) <= 3.1.0 - Cross-Site Request Forgery to Payment Settings Change and PayPlug Account Connection via payplug_api REST Routes
- ID
- WPSEC-2026-1341
- Plugin
- PayPlug for WooCommerce (Official) (payplug)
- Affected
- all versions before 3.1.1
- Remediation
- Update to 3.1.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
- Weakness
- CWE-352
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-21
- Attack surface
- PayPlug for WooCommerce (Official) on WPSec AttackSurface
- Fix released
- Published
Description
The PayPlug for WooCommerce (Official) plugin for WordPress is vulnerable to Cross-Site Request Forgery via the payplug_api REST routes in all versions up to, and including, 3.1.0, due to the routes accepting GET requests, checking the user's capability once when the plugin loads instead of in the permission callback, and not validating a REST nonce. This makes it possible for unauthenticated attackers to disable the plugin's payment methods, disconnect the PayPlug account, or connect a PayPlug account they control via a forged request granted they can trick a site administrator or editor into performing an action such as clicking on a link.
References
- https://wpsec.com/vuln/WPSEC-2026-1341/
- https://plugins.svn.wordpress.org/payplug/tags/3.1.1/
- https://wordpress.org/plugins/payplug/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS