What’s Vulnerable › Vulnerabilities
CVE-2026-80341: Payment Plugins for PayPal WooCommerce < 2.0.26 - Subscriber+ Stored Payment Method Assignment via IDOR
- Severity: medium (CVSS 5.9 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-09-09 · updated 2026-09-09
- Weakness: CWE-863
Description
The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.26 does not verify that a stored payment method belongs to the user attaching it, allowing any authenticated user, such as a subscriber, to bind another customer's stored card to their own account and then charge or delete it. Exploitation requires the attacker to already know the payment provider's identifier for the victim's stored method, which the Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.26 does not expose.
Affected products
- Payment Plugins for PayPal WooCommerce: from 1.1.0 before 2.0.26 — fixed in 2.0.26
How to fix
Upgrade to a fixed version: Payment Plugins for PayPal WooCommerce 2.0.26. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-80341 or the next vulnerability affects your stack