{"id":"CVE-2026-39751","published":"2026-10-06T09:17:46.640","lastModified":"2026-10-06T15:04:25.990","description":"Unauthenticated Broken Access Control in PayPlug for WooCommerce (Official) <= 3.1.0 versions.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","cwes":["CWE-862"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/payplug/vulnerability/wordpress-payplug-for-woocommerce-official-plugin-3-1-0-broken-access-control-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"This CVE describes an unauthenticated broken access control vulnerability in the PayPlug for WooCommerce plugin, allowing attackers to bypass authentication and potentially modify payment configurations or data without needing valid credentials. This is a high-severity issue because it enables unauthorized access to sensitive payment processing functionality.","exploitability":"The exploit is relatively straightforward as it requires no authentication and can be executed by any remote attacker with access to the vulnerable plugin's endpoints, making it highly exploitable in practice.","blast_radius":"If exploited, this vulnerability could allow attackers to modify payment processing configurations, potentially leading to unauthorized transactions or data manipulation across multiple WooCommerce stores using the affected plugin version.","remediation":"Upgrade to PayPlug for WooCommerce version 3.1.1 or later to remediate this broken access control vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["access-control","ecommerce","woocommerce","payment-processing"],"model":"garnet-coder","analyzedAt":"2026-10-17T09:04:06.882Z"}}