What is CVE-2026-12966?

CVE-2026-12966 is a medium-severity vulnerability in Direct Payments For Woocommerce, classified under Improper Access Control. CVSS score: 5.3/10. Published 2026-08-01.

How severe is CVE-2026-12966?

Medium severity. CVSS v3 base score is 5.3 out of 10.

Vulnerability in Direct Payments For Woocommerce

CVE-2026-12966

The Direct Payments for WooCommerce WordPress plugin before 2.5.3 does not verify that the requester owns the targeted WooCommerce order in several unauthenticated AJAX handlers before changing its status and overwriting its payment metadata, allowing unauthenticated attackers to tamper with other customers' orders, including forging a "payment sent" state, overwriting the payment-method label, and attaching forged payment-proof files.

EPSS: 0.002 (12.7th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N.

Affected products

Unknown Direct Payments For Woocommerce — versions 0

Weakness classification (CWE)

CWE-284 — Improper Access Control

References

contact@wpscan.com (technical-description, exploit, vdb-entry)

Frequently asked questions

What is CVE-2026-12966?: CVE-2026-12966 is a medium-severity vulnerability in Direct Payments For Woocommerce, classified under Improper Access Control. CVSS score: 5.3/10. Published 2026-08-01.
How severe is CVE-2026-12966?: Medium severity. CVSS v3 base score is 5.3 out of 10.