CVE-2026-123088 UniPAY Payment Gateway For WooCommerce < 2.4 - Unauthenticated Order Key and Customer PII Disclosure

Q: What is CVE-2026-123088?

CVE-2026-123088 is a medium-severity vulnerability in Unknown UniPAY Payment Gateway For WooCommerce, published on 9 Nov 2026.

Q: Is CVE-2026-123088 being exploited?

There is no known exploitation of CVE-2026-123088 in the wild and no public exploit code.

Q: How do I fix CVE-2026-123088?

No fix has been published for CVE-2026-123088 yet. Limit exposure of the affected software until one is available.

Medium 5.3 Published 9 Nov 2026 Updated 9 Nov 2026

Exploited in the wild: Not known
Fix: None listed

What is CVE-2026-123088?

CVE-2026-123088 is a medium-severity vulnerability in Unknown UniPAY Payment Gateway For WooCommerce, published on 9 Nov 2026.

Official description

The UniPAY Payment Gateway For WooCommerce WordPress plugin before 2.4 does not perform any authorization check before returning an order's order-received URL for an attacker-supplied order id, exposing the order's secret key in the redirect and allowing unauthenticated attackers to enumerate orders and disclose customers' personal data (name, email address, phone number and address).

Weakness: CWE-200

Which versions are affected by CVE-2026-123088?

How do I fix CVE-2026-123088?

No fix has been published for CVE-2026-123088 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-123088 being exploited?