{
 "id": "WPSEC-2026-1341",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1341/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1341/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1341/index.md",
 "title": "PayPlug for WooCommerce (Official) <= 3.1.0 - Cross-Site Request Forgery to Payment Settings Change and PayPlug Account Connection via payplug_api REST Routes",
 "description": "The PayPlug for WooCommerce (Official) plugin for WordPress is vulnerable to Cross-Site Request Forgery via the payplug_api REST routes in all versions up to, and including, 3.1.0, due to the routes accepting GET requests, checking the user's capability once when the plugin loads instead of in the permission callback, and not validating a REST nonce. This makes it possible for unauthenticated attackers to disable the plugin's payment methods, disconnect the PayPlug account, or connect a PayPlug account they control via a forged request granted they can trick a site administrator or editor into performing an action such as clicking on a link.",
 "plugin": {
  "slug": "payplug",
  "name": "PayPlug for WooCommerce (Official)",
  "full_name": "PayPlug for WooCommerce (Official)",
  "wordpress_org": "https://wordpress.org/plugins/payplug/",
  "advisories_url": "https://wpsec.com/vuln/plugin/payplug/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/payplug"
 },
 "type": "CSRF",
 "cwe": [
  "CWE-352"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.5,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "3.1.1",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 3.1.1"
  ]
 },
 "introduced_in": null,
 "fixed_in": "3.1.1",
 "remediation": "Update to 3.1.1 or later.",
 "fix_released": "2026-10-20T12:31:42+00:00",
 "published": "2026-10-21T12:44:50+00:00",
 "updated": "2026-10-21T10:35:23.978590+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1341/",
  "https://plugins.svn.wordpress.org/payplug/tags/3.1.1/",
  "https://wordpress.org/plugins/payplug/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/payplug",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-21"
 }
}