CyberRota Analysis
AI-GeneratedThe PayPlus Payment Gateway plugin for WordPress prior to version 8.2.2 is vulnerable due to insufficient authorization and order-ownership validation in an AJAX action accessible to unauthenticated users. This flaw could allow attackers to disclose secret order keys for arbitrary WooCommerce orders and potentially alter order statuses, posing a risk to e-commerce operations. WordPress site administrators using this plugin should prioritize updating to the latest version to mitigate these risks.
Original NVD Description
The PayPlus Payment Gateway WordPress plugin before 8.2.2 does not perform authorization or order-ownership validation in one of its AJAX actions available to unauthenticated users, allowing them to disclose the secret order key of arbitrary WooCommerce orders and, under some configurations, to modify order statuses.