CVE-2026-12966
Direct Payments for WooCommerce < 2.5.3 - Unauthenticated Cross-Customer Order Tampering via digages AJAX Actions
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The Direct Payments for WooCommerce WordPress plugin before 2.5.3 does not verify that the requester owns the targeted WooCommerce order in several unauthenticated AJAX handlers before changing its status and overwriting its payment metadata, allowing unauthenticated attackers to tamper with other customers' orders, including forging a "payment sent" state, overwriting the payment-method label, and attaching forged payment-proof files.
| Vendor | unknown |
| Product | direct payments for woocommerce |
| Published | Aug 1, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown direct payments for woocommerce
Be the first to know when new unknown vulnerabilities affecting unknown direct payments for woocommerce are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Direct Payments for WooCommerce
0 < 2.5.3
References
Credits
Pedro Pinho WPScan