---
id: CVE-2026-12966
title: >-
  The Direct Payments for WooCommerce  WordPress plugin before 2.5.3 does not
  verify that the requester owns the targeted WooCommerce order in several
  unauthenticated AJAX handlers before changing its status and overwriting its
  payment met…
summary: >-
  The Direct Payments for WooCommerce  WordPress plugin before 2.5.3 does not
  verify that the requester owns the targeted WooCommerce order in several
  unauthenticated AJAX handlers before changing its status and overwriting its
  payment met…
severity: none
published: '2026-08-01'
updated: '2026-08-01'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-12966'
references:
  - url: 'https://wpscan.com/vulnerability/b2b7f90e-359f-4fb4-9b48-c87ecb229f76/'
    label: contact@wpscan.com
tags:
  - nvd
epss: 0.00221
epssPercentile: 0.12911
ingestedAt: '2026-08-02T01:16:32.298Z'
---

## Overview

The Direct Payments for WooCommerce  WordPress plugin before 2.5.3 does not verify that the requester owns the targeted WooCommerce order in several unauthenticated AJAX handlers before changing its status and overwriting its payment metadata, allowing unauthenticated attackers to tamper with other customers' orders, including forging a "payment sent" state, overwriting the payment-method label, and attaching forged payment-proof files.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.