CVE-2026-12973 is a missing authorization vulnerability (CWE-862) in the PayPlus Payment Gateway WordPress plugin prior to version 8.2.2. The plugin fails to perform authorization or order-ownership validation in an AJAX action accessible without authentication. This enables attackers to retrieve secret order keys for arbitrary WooCommerce orders and potentially modify order statuses under certain configurations. The vulnerability was publicly disclosed without an associated CVSS score or vendor advisory detailing remediation status.

Attackers can disclose secret order keys of arbitrary WooCommerce orders, which may lead to unauthorized access to order details. Additionally, under some configurations, attackers can modify order statuses, potentially disrupting order processing or causing fraudulent order manipulation. This compromises the integrity and confidentiality of order data within affected installations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable AJAX action if possible, and monitor for unusual activity related to order management. Avoid exposing the plugin to untrusted users or networks.