CVE-2026-80341

Deferred Deferred - Pending Action

Unauthorized Payment Method Binding in PayPal WooCommerce Plugin

Publication date: 2026-09-09

Last updated on: 2026-09-09

Assigner: WPScan

Description

The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.26 does not verify that a stored payment method belongs to the user attaching it, allowing any authenticated user, such as a subscriber, to bind another customer's stored card to their own account and then charge or delete it. Exploitation requires the attacker to already know the payment provider's identifier for the victim's stored method, which the Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.26 does not expose.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-09

Last Modified

2026-09-09

Generated

2026-09-29

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-27

NVD

CVE-2026-80341

EUVD

EUVD-2026-74706

Affected Vendors & Products

Vendor	Product	Version / Range
payment_plugins	paypal_woocommerce	to 2.0.26 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This vulnerability is an Insecure Direct Object Reference (IDOR) flaw in the Payment Plugins for PayPal WooCommerce WordPress plugin before version 2.0.26. It allows any authenticated user, including subscribers, to attach another customer's stored payment method to their own account without proper verification. This could enable them to charge or delete the payment method.

Detection Guidance

To detect this vulnerability, check if your WordPress site uses the Payment Plugins for PayPal WooCommerce plugin version prior to 2.0.26. Use commands like 'wp plugin list' in WP-CLI or inspect the plugin version in the WordPress admin panel under Plugins.

Impact Analysis

If you use the vulnerable plugin version, an attacker with access to your account could link your stored payment methods to their account. This could lead to unauthorized charges or deletion of your payment methods, potentially resulting in financial loss or disruption of services.

Compliance Impact

This vulnerability could lead to unauthorized access to and manipulation of stored payment methods, violating data protection principles under GDPR and HIPAA. It may result in unauthorized transactions or data breaches, exposing sensitive financial and personal information.

Mitigation Strategies

Immediately update the Payment Plugins for PayPal WooCommerce plugin to version 2.0.26 or later. Review user accounts for unauthorized payment method attachments and revoke any suspicious activity.

Hi! I’m here to help you understand CVE-2026-80341. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70