CVE-2026-13399

Received Received - Intake

Unauthenticated Payment Bypass in PayPal WooCommerce Plugin

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: WPScan

Description

The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.20 does not have proper authorization checks on a REST endpoint, allowing unauthenticated users to bypass payments

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-06

Last Modified

2026-08-06

Generated

2026-08-07

AI Q&A

2026-08-07

EPSS Evaluated

N/A

NVD

CVE-2026-13399

Affected Vendors & Products

Vendor	Product	Version / Range
payment_plugins	paypal_woocommerce	to 2.0.20 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is in the Payment Plugins for PayPal WooCommerce WordPress plugin before version 2.0.20. It lacks proper authorization checks on a REST endpoint, allowing unauthenticated users to bypass payment requirements.

Detection Guidance

To detect this vulnerability, check if your WordPress site uses the Payment Plugins for PayPal WooCommerce plugin version before 2.0.20. Verify the plugin version in the WordPress admin panel under Plugins. If outdated, update immediately. No specific commands are provided in the context.

Impact Analysis

Unauthenticated users could exploit this to make purchases without paying, leading to financial losses for the website owner. It undermines the integrity of payment processing.

Compliance Impact

This vulnerability could lead to unauthorized transactions, potentially violating financial transaction security requirements in GDPR or HIPAA if payment data is involved.

Mitigation Strategies

Update the Payment Plugins for PayPal WooCommerce WordPress plugin to version 2.0.20 or later to address the authorization bypass issue.

Hi! I’m here to help you understand CVE-2026-13399. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70