CVE-2026-39751

Summary

This CVE describes an unauthenticated broken access control vulnerability in the PayPlug for WooCommerce plugin, allowing attackers to bypass authentication and potentially modify payment configurations or data without needing valid credentials. This is a high-severity issue because it enables unauthorized access to sensitive payment processing functionality.

Exploitability

The exploit is relatively straightforward as it requires no authentication and can be executed by any remote attacker with access to the vulnerable plugin's endpoints, making it highly exploitable in practice.

Blast radius

If exploited, this vulnerability could allow attackers to modify payment processing configurations, potentially leading to unauthorized transactions or data manipulation across multiple WooCommerce stores using the affected plugin version.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to PayPlug for WooCommerce version 3.1.1 or later to remediate this broken access control vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.