The PayPlug for WooCommerce plugin fails to verify that a requester owns an order when processing a payment request, allowing unauthenticated users to view another customer's order key and cancel their unpaid guest order. This results in unauthorized disclosure of sensitive order identifiers (confidentiality impact) and the ability to alter order state, effectively denying service to the legitimate owner (integrity impact). The flaw is an improper access control weakness, categorized as CWE-284 and CWE-285.

All installations of the PayPlug for WooCommerce WordPress plugin from versions 2.9.0 through 3.1.0 inclusive are affected. Updated versions 3.1.1 and later contain the fix and should be deployed.

The vulnerability is exploitable without prior authentication by sending a request to the payplug_create_intent endpoint. While no CVSS score is provided, the lack of EPSS information and absence from CISA’s KEV catalog mean the exploit probability is unknown, but the impact is significant. An attacker could potentially enumerate orders and cancel them, leading to financial loss and service disruption. Immediate remediation is advised.