Inadequate Payment Method Verification in Payment Plugins for PayPal WooCommerce
CVE-2026-80341
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 9 September 2026
Badges
What is CVE-2026-80341?
The Payment Plugins for PayPal WooCommerce WordPress plugin prior to version 2.0.26 suffers from an improper authorization vulnerability. This flaw allows any authenticated user, including subscribers, to link another user's stored payment method to their own account without adequate verification. An attacker needs to know the unique identifier for the victim's payment method; however, this information is not disclosed by the plugin. Consequently, such vulnerabilities can lead to unauthorized transactions, where an attacker might initiate charges or delete stored cards belonging to other users.
Affected Version(s)
Payment Plugins for PayPal WooCommerce 1.1.0 < 2.0.26
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.