CVE-2026-39643
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
The Payment Plugins for PayPal WooCommerce plugin for WordPress has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This issue affects versions up to and including 2.0.13.
Risk Assessment
An unauthorized user can manipulate payment settings or transaction data, leading to financial losses and data leakage.
Recommendation
Update the Payment Plugins for PayPal WooCommerce plugin as soon as possible to a version that includes a security fix.
Original NVD description (English source)
Missing Authorization vulnerability in Payment Plugins Payment Plugins for PayPal WooCommerce pymntpl-paypal-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Payment Plugins for PayPal WooCommerce: from n/a through <= 2.0.13.