CVE-2026-13692 — PayU CommercePro < 3.9.0 - Unauthenticated Order Tampering

CVE-2026-13692

PayU CommercePro < 3.9.0 - Unauthenticated Order Tampering PUBLISHED

Description (CNA)

The PayU CommercePro Plugin WordPress plugin before 3.9.0 does not verify the payment-gateway signature before applying order modifications, allowing unauthenticated attackers to tamper with the totals, shipping and metadata of arbitrary WooCommerce orders.

Affected (CNA)

Vendor / product	Versions
Unknown / PayU CommercePro Plugin	affected 0 before 3.9.0

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/e2dc15c7-2210-4be8-b7f3-55a9477e488d/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.