No-login order tampering: nine WordPress flaws (CVE-2026-13692)

On July 29, 2026, nine WordPress plugin and theme vulnerabilities were filed with the NVD in a single batch by WPScan. For anyone running an online store, the most direct of them is in PayU CommercePro Plugin, which connects the Indian payment provider PayU to WooCommerce: an attacker who is not logged in can impersonate the payment gateway's callback and rewrite the totals, shipping and metadata of any order. WPScan's own testing took that as far as dropping an order total to zero by injecting fake discount entries.

The affected products are PayU CommercePro Plugin for payments, the Streamit theme for video streaming sites, WP Media Folder Addon for cloud storage sync, UsersWP for membership features, Easy Appointments for bookings, ShinyStat Analytics for site analytics, WOLF for bulk post editing, miniOrange Social Login and Register for social sign-in, and PhotoSwipe for image lightboxes. For the six whose install counts are published on WordPress.org, the total comes to more than 52,000 sites.

The short version: six of the nine have a fixed release and three do not. One of those three, PhotoSwipe, is no longer distributed on WordPress.org at all, so the action there is deletion rather than an update. On top of that, two of the nine have published version information that does not match reality — PayU and Easy Appointments, both covered below. And none of the nine carry a CVSS score in the NVD. With no numbers to sort by, the ordering used here is whether the attacker needs to log in. The same format covers the eighteen published on July 28 and the four on July 23.

What happened across the nine

The nine split cleanly in two: five that anyone can hit from the outside, and four that need either a tricked user or an account of some kind. The first group is reachable simply because the site is on the internet, which settles the order you should work in.

The five that need no login are PayU CommercePro Plugin (order total tampering), the Streamit theme (execution of an attacker-chosen PHP function), WP Media Folder Addon (arbitrary file read), miniOrange Social Login and Register (log in as any account), and ShinyStat Analytics (read unpublished product data). Streamit stands out: it lets an attacker name a PHP function and supply its arguments, which amounts to remote code execution.

The remaining four are UsersWP (an attacker who already knows the credentials walks past two-factor auth), WOLF (a logged-in administrator has to be lured to a booby-trapped page), Easy Appointments (a subscriber account is required), and PhotoSwipe (an author account is required). Each has a precondition on the attacker's side, so none of them get hit by blind automated sweeps. That is a reason to schedule them second, not a reason to skip them. All nine are flaws in plugins and themes rather than WordPress core, so sites without them installed are unaffected. Core-side issues are covered separately in our WordPress core vulnerability roundup.

Affected products at a glance

Here are the nine in one table, with the no-login cases first. Install counts come from the WordPress.org plugin API; products that are not distributed there are left blank. Every severity cell reads "none in NVD" because no score has been assigned — we have not filled in numbers of our own.

Streamit is a commercial theme and WP Media Folder Addon is a paid add-on; neither is distributed through WordPress.org, so no install figure is published for them. PhotoSwipe's count is unavailable because the listing is closed. Blank cells mean we looked and could not find the number.

Who comes for this, and what they take

Payment tampering attracts a different crowd from the people who hijack sites to resell them. The ones who move on a flaw like the PayU bug are small-scale carding operators who spend their days probing online checkouts for gaps, and what they want is not administrator access — it is the goods. A flaw that lets an order total be rewritten to zero after the fact fits that goal exactly. Streamit, which lets an attacker create an administrator account, draws a different group: people who want the server itself as a relay or hosting node. That one gets folded into automated sweeps quickly, and because it is a theme rather than a plugin, the share of installs sitting untouched for years is higher.

The method is plain enough. They fire forged payment-gateway callbacks straight at the store's WordPress install. PayU CommercePro Plugin wrote the order's amount, shipping, discounts and metadata into the database before checking the signature that came with the callback. When the signature check then failed, the values it had already written stayed put. From there it is a matter of pushing a small legitimate payment through, or slipping past a human glance at the order screen, until the goods ship. ShinyStat Analytics' "read unpublished products without logging in" flaw looks minor on its own, but it leaks the price and copy of products that have not launched yet, which is useful groundwork for the same kind of activity.

The store absorbs the first loss. On the order screen the transaction looks normal; the stock and the shipping cost are gone, and the mismatch only shows up when the processor's settlement figures fail to reconcile with the books. Tampering one order at a time is quiet, and small amounts hide well among genuine orders. Customers absorb the second loss. A flaw like the miniOrange one, which lets someone sign in as another user, hands over order history, saved addresses and the ability to change a delivery address. The same pattern played out in May with the Kirki admin takeover across 500,000 sites, where exploitation was confirmed after disclosure.

Five that need no login

Start here. If any of these five are installed, deal with them before anything else on your list.

CVE-2026-13692: PayU CommercePro Plugin lets order totals be rewritten

PayU CommercePro Plugin connects the Indian payment provider PayU to WooCommerce stores, and runs on 7,000+ sites. The flaw (CVE-2026-13692) is that the plugin modified order data before verifying the signature on the gateway's callback.

The plugin exposes /wp-json/payu/v1/get-payment-success-update to receive payment-completed notifications, and that endpoint is open without authentication — normal enough for a gateway integration. The problem was the order of operations. The old code pulled the order ID out of the incoming data, wrote the payment method, bank code and shipping method onto the order, reconciled the discount entries, and only then moved on to comparing the hash. When the comparison failed, everything written before it remained in the database.

WPScan's write-up shows an attacker injecting fraudulent discount entries to bring an order total down to zero and overwrite the payment metadata. The order status stays "pending," so nothing obviously looks wrong on the store's admin screen. It is classified as CWE-862 (missing authorization), and needs neither a login nor a customer account.

Now the part worth reading twice. The advisory lists no fixed version, but the WordPress.org changelog for 3.9.0 (released July 8, 2026) says plainly: "Security: Fixed reported order price change vulnerability." Comparing the shipped 3.8.9 and 3.9.0 packages confirms it — the callback now routes through a different handler, the pre-validation writes are gone, and the shipping address is only applied after the order is confirmed paid. So 3.9.0 and later are fine. There is no need to read the CVE entry as "unfixable" and rip out the payment integration.

CVE-2026-13423: the Streamit theme runs any PHP function you name

Streamit is a video streaming and OTT theme sold by Iqonic Design, distributed through ThemeForest rather than WordPress.org, so no install count is published. The flaw (CVE-2026-13423) is the heaviest of the nine.

The theme registers AJAX endpoints for browser-to-server calls. One of them is open to unauthenticated requests and performs neither an authorization check nor nonce verification. What that endpoint does is call a PHP function named in the request, with an argument array also supplied in the request.

In other words, an attacker picks the function to run on your server. The NVD description gives creating an administrator account as the worked example, and the path from there to privilege escalation and remote code execution is direct. The classification is CWE-94 (improper control of code generation). WPScan's entry states that the proof of concept will stay unpublished until a fix exists.

Versions through 4.5.0 are affected, and no fixed release was available as of this writing. Streamit being a paid theme, it sits outside WordPress.org's auto-update path. If you run it, check the vendor dashboard or your ThemeForest account for an update directly; if none exists, the options narrow to blocking that endpoint or replacing the theme. This is not the theme's first advisory — it also had vulnerabilities published in 2025.

CVE-2026-11974: WP Media Folder Addon exposes server files (an incomplete earlier fix)

WP Media Folder Addon is JoomUnited's paid add-on that syncs the media library with Google Drive, Dropbox, OneDrive and Nextcloud. The flaw (CVE-2026-11974) is that two AJAX actions reachable without logging in feed an unvalidated user-supplied parameter into a file read.

That yields arbitrary file disclosure, plus server-side request forgery on sites where a cloud storage connection is configured. Top of the list of files you do not want read is wp-config.php, which holds the database credentials and the authentication keys in one place. The classification is CWE-22 (path traversal).

The detail that stands out is that NVD's own description calls this an incomplete fix of CVE-2026-9690, published in June 2026. That earlier patch hardened one of the cloud-storage handlers and left the structurally identical ones alone. The vendor changelog shows 4.0.2 adding "URL validation before fetching remote content" — that was the earlier fix. Nothing security-related appears in 4.1.0 through 4.1.6, and the current 4.1.6 is still unpatched.

WPScan is holding the proof of concept until August 8, 2026 to give people time to update — which also means the attack steps become public on August 8. With no patch available, the practical moves are limited: disable the add-on if you are not actually using cloud sync, and restrict admin access if you are. Past advisories for the same add-on are collected in Patchstack's database.

CVE-2026-14300: miniOrange Social Login lets a one-time code be replayed against any account

miniOrange Social Login and Register lets visitors sign in with Google, Discord, LinkedIn, Twitter and similar accounts, and runs on 10,000+ sites. The flaw (CVE-2026-14300) is that the one-time code used for email verification was never bound to the account it was issued for.

The attack shape matches the SMS Alert flaw covered in the previous day's roundup. The attacker requests a verification code for an email address they control and receives it through the normal flow. They then replay that same code against the victim's email address. Because the code is all the system checks, it issues a valid session for the victim's account. Administrator accounts included.

Two conditions have to hold: the optional "Profile Completion" email-verification feature must be enabled, and social login must be configured. Sites missing either are not exploitable. Checking those settings takes longer than just updating, though.

The fix landed in 7.8.0, where the changelog says only "Security fixes." Here is how that lines up with our earlier coverage: our article on the miniOrange vulnerabilities told readers to move to 7.8.1 because of a separate flaw, CVE-2026-12761. Since 7.8.1 comes after 7.8.0, anyone who followed that advice has already cleared CVE-2026-14300 with no extra work. If you are still on 7.7.x or earlier, WPScan has scheduled the proof of concept for August 8, so get to 7.8.1 before then.

CVE-2026-11351: ShinyStat Analytics leaks unpublished products to anyone

ShinyStat Analytics wires the Italian analytics service ShinyStat into WordPress, with 1,000+ installs. The flaw (CVE-2026-11351) is that one of its REST API endpoints performs no authorization check, letting anyone retrieve non-published WooCommerce products.

Per WPScan's advisory, a plain request to /wp-json/shinystat/v1/product/<id> returns the title, description, price and URL of draft, pending and private products. The IDs are sequential, so walking them enumerates everything unpublished. WordPress core's own APIs answer the same request with a 401 — the plugin opened the hole.

Nobody takes over the site with this, but having the price and copy of an unreleased product leak in advance is a real commercial problem: sale pricing goes out early, and competitors get to react first. Versions before 1.0.17 are affected, and 1.0.17 fixes it. The changelog names the change directly — "Added product status check in get_product_details rest api." Since 1.0.17 is also the current release, updating settles it.

Four that need an account or a victim

These four come with a precondition. That said, a subscriber account is free to obtain on any site with open registration, and luring an administrator to a prepared page is not a difficult trick. Later in the queue does not mean safe to ignore.

CVE-2026-13690: UsersWP lets two-factor authentication be skipped

UsersWP adds front-end registration, login, profiles and member directories, and runs on 20,000+ sites. The flaw (CVE-2026-13690) is that its two-factor login handler never validated the selected authentication provider.

Two-factor auth exists as the last line of defence after a password leaks. In this handler, the requested authentication method was trusted, and the case where no matching provider was found was handled loosely. The result: an attacker who already has a user's ID and password can skip the second factor entirely and log in. That makes it not an unauthenticated flaw — but it does mean the second factor stops being worth anything, which is the whole reason the site turned it on. With reused-password dumps in wide circulation, plenty of sites meet the precondition.

The fix is 1.2.67 (released June 30, 2026); the changelog records it as "Missing WP 2FA provider bypassed login – FIXED." This one conflicts with our own earlier guidance. Our article on the UsersWP vulnerability pointed readers to 1.2.66 for a separate flaw, CVE-2026-13492. This fix ships in 1.2.67, one release later. Sites that stopped at 1.2.66 on that advice are still exposed to this one. The current release is 1.2.69, so go all the way there. WPScan's proof of concept is due on August 8.

CVE-2026-14234: WOLF lets an administrator be tricked into planting a script

WOLF edits post fields in bulk through a spreadsheet-style table (its WordPress.org slug is bulk-editor), with 4,000+ installs. The flaw (CVE-2026-14234) is an AJAX action with neither nonce nor capability checking.

The attacker sets up a page and gets a logged-in administrator to open it. The browser sends the request with the session cookie attached, so the site treats it as the administrator's own action. WPScan identifies the target as the wpbe_redraw_table_row action, which will write arbitrary content — scripts included — into a post's body. From then on, the injected code runs in the browser of everyone who reads that post. Stored XSS, in short.

Sibling handlers in the same plugin do run the checks, so this was one handler that slipped through. Versions before 1.1.0 are affected and 1.1.0 fixes it; the changelog for that release just says "security fix from wordpress.org." The current release is 1.1.1, and the developer warns that after updating, field titles may show as "-" and each one needs to be cleared and re-saved in Settings. Do not panic if the screen looks wrong afterwards.

CVE-2026-14224: Easy Appointments lets someone rewrite another customer's contact details

Easy Appointments handles online booking for salons, classes and professional services, with 10,000+ installs. The flaw (CVE-2026-14224) is that the customer-data update action never checked that the targeted appointment belonged to the person making the request.

The action does verify a nonce. But that nonce is a shared one, obtainable by anyone who opens the edit form for their own appointment, and there was no check tying the appointment ID to the caller. A subscriber-level user with a single booking of their own can therefore overwrite the email, name, phone and description on somebody else's appointment.

The consequence is the interesting part. Easy Appointments treats that metadata as the appointment's contact details, so when an administrator later changes the appointment status with customer notifications enabled, the victim's booking notification is delivered to the attacker's email address — date, time, name and service, sent as a legitimate message from the business.

The version information is where this one goes wrong. The CVE lists 3.12.26 and earlier as affected, which reads as "fixed in 3.12.27," and WPScan's entry says no known fix. Comparing the shipped 3.12.26, 3.12.27 and 3.12.28 packages tells a different story: the handler in 3.12.26 and 3.12.27 is byte-for-byte identical, and the ownership check first appears in 3.12.28. That release adds an existence check on the appointment plus a rule that any user without manage_options gets a 403 unless the booking is their own.

The changelog backs it up. The 3.12.28 entry (released July 4, 2026) lists eight security fixes, one of which reads "missing ownership check allowing cross-user appointment modification. Reported by Duy Tran" — the same researcher credited on this CVE. Check only whether you are on 3.12.28 or later. Sites parked on 3.12.27 sit outside the published affected range while remaining fully exploitable.

CVE-2026-13605: PhotoSwipe turns a title attribute into XSS, and the plugin is closed

PhotoSwipe is a lightbox plugin that enlarges images on click. The flaw (CVE-2026-13605) is that it takes the title attribute from author-supplied link markup and writes it into the page DOM as a caption without escaping it.

What makes it work is a quirk of WordPress's own sanitization. Users without the unfiltered_html capability — Author-level accounts, for instance — have dangerous markup stripped from their post content. The title attribute survives that pass. Since PhotoSwipe writes the value out unescaped, a single Author account is enough to run script in the browser of any visitor who clicks the link, administrators included.

The response here differs from the rest. This plugin was closed on WordPress.org on June 29, 2026, listed as a temporary closure pending a full review, and the affected range of 4.1.1.1 and below covers every release that exists. WPScan lists no fix either. A closed plugin stops showing "update available" in the admin screen, so an install can sit there indefinitely without a prompt. If you have it, the action is deletion, not an update — lightbox behaviour is easy to replace, and the install count is not even retrievable any more. While you are in the plugin list, scan for any "This plugin has been closed" warnings on other entries.

Two where the published details will mislead you

Two of the nine will lead you to the wrong conclusion if taken at face value — and they fail in opposite directions.

PayU's entry is more pessimistic than reality. There is no need to read "no known fix" as a reason to give up or tear out the payment integration — 3.9.0 and later handle it. Easy Appointments runs the other way and is more optimistic than reality: anyone who trusts "3.12.26 and earlier" and stops at 3.12.27 stays exposed while believing they are done. Neither gap is visible from the CVE record alone; both require looking at the vendor changelog and the shipped files.

This kind of drift is common. The July 28 roundup covered the same problem in Bookly, used on 60,000 sites, where versions outside the published affected range were still exploitable. Disclosure typically trails the fixed release by days or months, and newer releases appear in the gap. The practical takeaway: chasing exact version numbers from a CVE record is slower and less reliable than simply moving to the current release.

None of the nine carry a severity score

These nine share an awkward property: not one of them has a CVSS score in the NVD. All nine come from the same source, contact@wpscan.com, and WPScan does not attach scores to the CVE records it files. NVD has not re-scored them either.

Two practical consequences follow. One is that scanners and asset-management tools will disagree with each other — some leave the field blank, others substitute an estimate of their own, so the same CVE can read "critical" in one dashboard and "medium" in the next. The other is that any process that triggers remediation off a severity threshold quietly does nothing here. A policy of "patch anything CVSS 9.0 or above immediately" misses all nine.

WPScan does publish its own ratings on its site (9.8 for Streamit, 8.6 for WP Media Folder Addon, 8.1 for miniOrange, and so on). Those are WPScan's own assessments, not official NVD values. The table above says "none in NVD" precisely to keep that distinction intact. With no numbers to lean on, the workable filters are whether a login is required and whether you actually run the thing.

Is any of this being exploited

As of July 29, 2026, none of the nine appear in CISA's Known Exploited Vulnerabilities catalogue. Checking the catalogue directly turns up none of these CVE IDs. Nothing here is at the "already being hunted" stage yet.

Proof-of-concept status is mixed. No independent third-party releases turned up on GitHub or elsewhere, but WPScan itself has already published attack steps for five of them: PayU (injecting discount entries to zero out a total), Easy Appointments (grabbing the shared nonce and replaying it against another appointment ID), ShinyStat (the endpoint to hit), WOLF (the URL to feed an administrator), and PhotoSwipe. Subscriber-gated or not, that is public information.

The other four — Streamit, WP Media Folder Addon, UsersWP and miniOrange — have their proofs of concept withheld. Three of them (WP Media Folder Addon, UsersWP, miniOrange) carry a stated release date of August 8, 2026, while Streamit's is held until a fix ships. That August 8 date works as a realistic deadline for updating. WP Media Folder Addon deserves particular attention, since it will have attack steps published while still having no patch — inventory your usage before then. KEV listings only appear once exploitation has been observed, which is already too late to be useful as a trigger.

What to do now

Work through this order from the admin area.

Where to look during the review depends on the flaw. If your store runs PayU CommercePro Plugin, reconcile the processor's settlement records against your WooCommerce order totals. The tells are orders still marked "pending" that nonetheless shipped, discount lines nobody can account for, and shipping costs that came out at zero. For miniOrange, check the user list for accounts you did not expect and the administrator account for sign-ins you cannot place. For Easy Appointments, look at whether the contact email on a booking matches the person who made it. For WOLF, scan published post bodies for a stray <script>.

The check itself runs like this:

• ▸ Open Plugins and write down which of the nine are installed and their current versions
• ▸ Open Appearance > Themes and check for Streamit (paid themes sit outside auto-updates)
• ▸ Scan the plugin list top to bottom for any "This plugin has been closed" warning
• ▸ Update everything that can be updated, then load the public site once to confirm nothing broke
• ▸ Go back a month through WooCommerce orders and reconcile totals and discount lines

Day to day, the answer is still to delete what you do not use and keep auto-updates on for what you do. Three of these nine — closed, paid, or outside WordPress.org — produce no notification in the admin area at all. The "installed and forgotten" problem shows up again and again, including in our earlier WordPress plugin roundups and the three admin-takeover cases from July 16.

Summary

Of the nine published on July 29, 2026, the five that need no login come first. If you run a store, PayU CommercePro Plugin is the priority: order totals can be rewritten without authentication, and testing took one to zero. The Streamit theme allows an attacker-named PHP function to run and an administrator account to be created — the heaviest of the nine by content, and still unpatched. WP Media Folder Addon is also unpatched, and is a leftover from an incomplete June fix. miniOrange Social Login and ShinyStat Analytics both have fixed releases. The other four — UsersWP, WOLF, Easy Appointments and PhotoSwipe — need known credentials, a tricked administrator, or an account, so they queue behind the rest.

Four things to watch. PhotoSwipe is closed with no fix, so it gets deleted rather than updated. Two entries disagree with reality — PayU is listed as unfixed but 3.9.0 handles it, while Easy Appointments is listed as affecting 3.12.26 and earlier when 3.12.27 is vulnerable too and the fix is 3.12.28. None of the nine carry an NVD severity score, so score-threshold processes will skip them entirely. And three proofs of concept are scheduled for August 8, 2026, which sets a working deadline. On our own earlier guidance: UsersWP 1.2.66 does not cover this flaw and 1.2.67 or later is needed, whereas anyone who already moved to miniOrange 7.8.1 is covered for this one too. We will update this article if exploitation or a KEV listing is confirmed.

Sources

• ▸ NVD - CVE-2026-13692 (PayU CommercePro Plugin)
• ▸ NVD - CVE-2026-13423 (Streamit theme)
• ▸ NVD - CVE-2026-11974 (WP Media Folder Addon)
• ▸ NVD - CVE-2026-9690 (WP Media Folder Addon, the incomplete earlier fix)
• ▸ NVD - CVE-2026-13690 (UsersWP)
• ▸ NVD - CVE-2026-14224 (Easy Appointments)
• ▸ NVD - CVE-2026-11351 (ShinyStat Analytics)
• ▸ NVD - CVE-2026-14234 (WOLF)
• ▸ NVD - CVE-2026-14300 (miniOrange Social Login and Register)
• ▸ NVD - CVE-2026-13605 (PhotoSwipe)
• ▸ WPScan - PayU CommercePro <= 3.8.9 Unauthenticated Order Tampering
• ▸ WPScan - Streamit <= 4.5.0 Unauthenticated Arbitrary Function Call to RCE
• ▸ WPScan - WP Media Folder Addon <= 4.1.6 Arbitrary File Disclosure / SSRF
• ▸ WPScan - UsersWP < 1.2.67 Two-Factor Authentication Bypass
• ▸ WPScan - Easy Appointments <= 3.12.26 IDOR in Customer Data Update
• ▸ WPScan - ShinyStat Analytics < 1.0.17 Unauthenticated Product Disclosure
• ▸ WPScan - WOLF < 1.1.0 Stored XSS via CSRF
• ▸ WPScan - miniOrange Social Login < 7.8.0 Account Takeover
• ▸ WPScan - PhotoSwipe <= 4.1.1.1 Author+ Stored XSS
• ▸ WordPress.org - PayU CommercePro Plugin changelog (3.9.0 entry)
• ▸ WordPress.org - Easy Appointments changelog (3.12.28 entry)
• ▸ WordPress.org - UsersWP changelog (1.2.67 entry)
• ▸ WordPress.org - PhotoSwipe (closed on June 29, 2026)
• ▸ JoomUnited - WP Media Folder Cloud Addon changelog
• ▸ Patchstack - WP Media Folder Addon vulnerability list
• ▸ Iqonic Design - Streamit product page
• ▸ CISA - Known Exploited Vulnerabilities Catalog