CVE-2026-39643
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
The Payment Plugins for PayPal WooCommerce plugin for WordPress has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This issue affects versions up to and including 2.0.13.
Risk Assessment
An unauthorized user can manipulate payment settings or transaction data, leading to financial losses and data leakage.
Recommendation
Update the Payment Plugins for PayPal WooCommerce plugin as soon as possible to a version that includes a security fix.
Other vulnerabilities in Payment Plugins for PayPal WooCommerce
See all- CVE-2026-80342Medium
The Payment Plugins for PayPal WooCommerce WordPress plugin before version 2.0.27 does not verify that a PayPal order supplied in a payment request belongs to the WooCommerce order being paid unless that PayPal order has already been completed, allowing unauthenticated attackers to have another buyer's approved but uncaptured payment captured against an order of their own.
- CVE-2026-80341Medium
The Payment Plugins for PayPal WooCommerce WordPress plugin before version 2.0.26 does not verify that a stored payment method belongs to the user attaching it, allowing any authenticated user, such as a subscriber, to bind another customer's stored card to their own account and then charge or delete it. Exploitation requires the attacker to already know the payment provider's identifier for the victim's stored method, which the Payment Plugins for PayPal WooCommerce WordPress plugin before version 2.0.26 does not expose.
- CVE-2026-80340Medium
The Payment Plugins for PayPal WooCommerce plugin before version 2.0.26 does not validate the order key before adding order data to the JavaScript configuration output on the front end. This allows unauthenticated users to obtain the secret that gates access to any order and, through it, the customer's billing and shipping details, by iterating sequential order identifiers.
- CVE-2026-13399High
The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.20 does not have proper authorization checks on a REST endpoint, allowing unauthenticated users to bypass payments.
Original NVD description (English source)
Missing Authorization vulnerability in Payment Plugins Payment Plugins for PayPal WooCommerce pymntpl-paypal-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Payment Plugins for PayPal WooCommerce: from n/a through <= 2.0.13.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS