CVE-2026-39643
Missing Authorization in PayPal WooCommerce Plugin Allows Unauthorized Access
Publication date: 2026-04-08
Last updated on: 2026-04-13
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| payment_plugins | payment_plugins_for_paypal_woocommerce | to 2.0.13 (inc) |
| payment_plugins | pymntpl-paypal-woocommerce | to 2.0.13 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.
Can you explain this vulnerability to me?
CVE-2026-39643 is a Broken Access Control vulnerability in the WordPress Payment Plugins for PayPal WooCommerce Plugin, affecting versions up to and including 2.0.13.
The vulnerability arises from missing authorization, authentication, or nonce token checks in certain functions, which allows unauthenticated users to perform actions that normally require higher privileges.
It is classified under the OWASP Top 10 category A1: Broken Access Control and has a CVSS severity score of 5.3, indicating a low priority threat with limited impact.
How can this vulnerability impact me? :
This vulnerability could allow unauthenticated attackers to perform privileged actions within the affected plugin, potentially compromising the security of your WooCommerce payment processing.
Although it could be exploited in mass campaigns targeting many websites regardless of their traffic or popularity, the low severity score suggests that exploitation is unlikely and the impact is limited.
Immediate mitigation involves updating the affected plugin if possible or seeking assistance from hosting providers or web developers, but no official patch is currently available.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation involves updating the affected Payment Plugins for PayPal WooCommerce plugin if an update is available.
If no official patch is available, seek assistance from your hosting provider or web developers to implement temporary access control measures.
Consider using rapid mitigation services provided by Patchstack to reduce risk until a patched version is released.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability is a Broken Access Control issue in the Payment Plugins for PayPal WooCommerce plugin, caused by missing authorization checks. Detection typically involves verifying the plugin version and checking for unauthorized access attempts to privileged functions.
To detect if your system is vulnerable, first identify if the plugin version is 2.0.13 or earlier. You can do this by checking the installed plugin version in your WordPress admin dashboard or by inspecting the plugin files.
On the server, you can run commands to find the plugin version, for example:
- grep 'Version:' wp-content/plugins/pymntpl-paypal-woocommerce/readme.txt
- grep 'Version:' wp-content/plugins/pymntpl-paypal-woocommerce/pymntpl-paypal-woocommerce.php
Additionally, monitoring web server logs for suspicious requests to the plugin's endpoints that should require authorization can help detect exploitation attempts.
Since the vulnerability allows unauthenticated users to perform privileged actions, look for unusual POST or GET requests targeting the plugin's functions without proper authentication tokens.
Example command to search for suspicious access attempts in Apache logs:
- grep -i 'pymntpl-paypal-woocommerce' /var/log/apache2/access.log | grep -E 'POST|GET'
No specific detection scripts or signatures are provided in the available resources, so manual inspection and version checking are the primary methods.