{"id":"CVE-2026-110292","revision":"fc596fa88be84acd9b5faa2d57ded7ac","records":[{"revision":"fc596fa88be84acd9b5faa2d57ded7ac","observedAt":"2026-10-28T07:06:08.469+00:00","statement":{"source":"cve-program","id":"CVE-2026-110292","aliases":[],"title":"PayPlug for WooCommerce 2.9.0 - 3.1.0 - Unauthenticated Order Key Disclosure and Order Cancellation via payplug_create_intent","description":"The PayPlug for WooCommerce (Official) WordPress plugin before 3.1.1 does not verify that the requester owns the WooCommerce order named in a payment request, allowing unauthenticated users to disclose another customer's order key and cancel their unpaid guest order.","state":0,"publishedAt":"2026-10-28T06:00:22.829+00:00","modifiedAt":"2026-10-28T06:00:22.829+00:00","affected":[{"ecosystem":"Vendor product","name":"PayPlug for WooCommerce (Official)","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Unknown\",\n                    \"product\": \"PayPlug for WooCommerce (Official)\",\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\",\n                            \"version\": \"2.9.0\",\n                            \"lessThan\": \"3.1.1\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\"\n                }"}],"metrics":[],"references":["https://wpscan.com/vulnerability/91444324-4332-489e-9e97-f371d866c20c/"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-110292","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-110292","identifiers":["CVE-2026-110292"]},"retained":false,"historicalAffected":[]}],"coverage":[]}