CVE-2026-13692: Unknown Payu Commercepro Plugin

Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days.

The PayU CommercePro Plugin WordPress plugin before 3.9.0 does not verify the payment-gateway signature before applying order modifications, allowing unauthenticated attackers to tamper with the totals, shipping and metadata of arbitrary WooCommerce orders.

Affected products

• Unknown Payu Commercepro Plugin: before 3.9.0 (fixed in 3.9.0)

Published 2026-07-29. Last modified 2026-08-10.