CVE-2026-80340
UnknownSummary
The Payment Plugins for PayPal WooCommerce plugin before version 2.0.26 does not validate the order key before adding order data to the JavaScript configuration output on the front end. This allows unauthenticated users to obtain the secret that gates access to any order and, through it, the customer's billing and shipping details, by iterating sequential order identifiers.
Risk Assessment
The risk involves exposure of sensitive customer data (personal information, addresses) and potential unauthorized access to orders, which can compromise privacy and trust in the store.
Recommendation
It is recommended to immediately update the plugin to version 2.0.26 or later, which includes the fix for order key validation.
Other vulnerabilities in Payment Plugins for PayPal WooCommerce
See all- CVE-2026-80341Unknown
The Payment Plugins for PayPal WooCommerce WordPress plugin before version 2.0.26 does not verify that a stored payment method belongs to the user attaching it, allowing any authenticated user, such as a subscriber, to bind another customer's stored card to their own account and then charge or delete it. Exploitation requires the attacker to already know the payment provider's identifier for the victim's stored method, which the Payment Plugins for PayPal WooCommerce WordPress plugin before version 2.0.26 does not expose.
- CVE-2026-13399High
The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.20 does not have proper authorization checks on a REST endpoint, allowing unauthenticated users to bypass payments.
- CVE-2026-39643Medium
The Payment Plugins for PayPal WooCommerce plugin for WordPress has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This issue affects versions up to and including 2.0.13.
Original NVD description (English source)
The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.26 does not validate the order key before adding order data to the JavaScript configuration it outputs on the front end, allowing unauthenticated users to obtain the secret that gates access to any order and, through it, that customer's billing and shipping details, by iterating sequential order identifiers.