CVE-2026-13692— PayU CommercePro <= 3.8.9 - Unauthenticated Order Tampering
Possible ATT&CK Techniques 1AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Unknown | PayU CommercePro Plugin | ≤ 3.8.9 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-13692
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
PayU CommercePro <= 3.8.9 - Unauthenticated Order Tampering
Source: CVE Program / CVE List V5
Vulnerability Description
The PayU CommercePro Plugin WordPress plugin through 3.8.9 does not verify the payment-gateway signature before applying order modifications, allowing unauthenticated attackers to tamper with the totals, shipping and metadata of arbitrary WooCommerce orders.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | PayU CommercePro Plugin | 0 ~ 3.8.9 | - |
II. Public POCs for CVE-2026-13692
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-13692
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-13692 (1)
- 🔗 PayU CommercePro <= 3.8.9 – Unauthenticated Order Tampering | CVE 2026-13692 | Plugin Vulnerabilities Read full article exploitvdb-entrytechnical-description
Same Patch Batch · Unknown · 2026-07-29 · 9 CVEs total
| CVE-2026-14234 | WOLF - WordPress Posts Bulk Editor and Manager < 1.1.0 - Stored XSS via CSRF | |
| CVE-2026-14224 | Easy Appointments <= 3.12.26 - Subscriber+ Cross-User Appointment Data Modification via ID | |
| CVE-2026-14300 | miniOrange Social Login and Register < 7.8.0 - Unauthenticated Account Takeover | |
| CVE-2026-13690 | UsersWP < 1.2.67 - Two-Factor Authentication Bypass | |
| CVE-2026-11351 | ShinyStat Analytics < 1.0.17 - Unauthenticated Non-Published Product Information Disclosur | |
| CVE-2026-11974 | Media folder Addon <= 4.1.6 - Unauthenticated Arbitrary File Download | |
| CVE-2026-13605 | Photo Swipe <= 4.1.1.1 - Author+ Stored XSS via title Attribute | |
| CVE-2026-13423 | Streamit <= 4.5.0 - Unauthenticated Remote Code Execution via Arbitrary Function Call |
IV. Related Vulnerabilities
Same vendor: Unknown
- CVE-2026-14310
Tutor LMS < 4.0.0 - Subscriber+ Cross-Course Q&A Content Dis - CVE-2026-14239
Tourmaster < 5.4.8 - Stored XSS via CSRF - CVE-2026-14305
WP Delicious < 1.10.2 - Unauthenticated Arbitrary Post Meta - CVE-2026-13344
Essential Addons for Elementor - Lite < 6.6.10 - Contributor - CVE-2026-13330
Animation Addons for Elementor < 2.7.0 - Author+ Stored XSS
V. Comments for CVE-2026-13692
No comments yet