CVE-2026-13399

HighCVSS 7.5

Published: 06/08/2026(UTC)Updated: 26/08/2026(UTC)Translated: 07/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.28%

20th percentile - higher than 20% of all known CVEs

Summary

The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.20 does not have proper authorization checks on a REST endpoint, allowing unauthenticated users to bypass payments.

Risk Assessment

Unauthenticated users can place orders without paying, leading to financial losses and order integrity issues.

Recommendation

Update the plugin to version 2.0.20 or later. Review REST endpoint configuration and add proper authorization.

Other vulnerabilities in Payment Plugins for PayPal WooCommerce

CVE-2026-39643Medium
The Payment Plugins for PayPal WooCommerce plugin for WordPress has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This issue affects versions up to and including 2.0.13.

Original NVD description (English source)

The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.20 does not have proper authorization checks on a REST endpoint, allowing unauthenticated users to bypass payments