VULNERABILITY INTELLIGENCE
CVE-2026-12966
CVSS score5.3 MEDIUM
EPSS probability0.30%
CISA KEVNot currently listed
Published2026-08-01
Last modified2026-08-26
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Description
The Direct Payments for WooCommerce WordPress plugin before 2.5.3 does not verify that the requester owns the targeted WooCommerce order in several unauthenticated AJAX handlers before changing its status and overwriting its payment metadata, allowing unauthenticated attackers to tamper with other customers' orders, including forging a "payment sent" state, overwriting the payment-method label, and attaching forged payment-proof files.
Weakness classification
- 134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-284