CVE-2026-12966CWE-284broken-access-control

CVE-2026-12966

Medium · published August 1, 2026

CVSS v3.1

5.3

EPSS

Percentile

22.0

In the wild

Unconfirmed

What it is

The Direct Payments for WooCommerce WordPress plugin before 2.5.3 does not verify that the requester owns the targeted WooCommerce order in several unauthenticated AJAX handlers before changing its status and overwriting its payment metadata, allowing unauthenticated attackers to tamper with other customers' orders, including forging a "payment sent" state, overwriting the payment-method label, and attaching forged payment-proof files.

The record

Technical detail

CVSS v3.1: 5.3 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0: Not supplied
EPSS: 0.00304 · 22.0th percentile
Weakness: CWE-284 · Improper Access Control
Published: 2026-08-01T11:16Z

References (1)

https://wpscan.com/vulnerability/b2b7f90e-359f-4fb4-9b48-c87ecb229f76/ · [email protected]

EPSS history

Timeline

01 AUG 06:00Z
Direct Payments for WooCommerce < 2.5.3 - Unauthenticated Cross-Customer Order Tampering via digages AJAX Actions
cvelistv5