Authentication Flaw in Payment Plugins for PayPal WooCommerce by WordPress
CVE-2026-80342
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 23 September 2026
Badges
What is CVE-2026-80342?
The Payment Plugins for PayPal WooCommerce plugin prior to version 2.0.27 allows unauthenticated attackers to exploit an authentication flaw. Specifically, this vulnerability permits an attacker to capture a PayPal order intended for another buyer, provided the order in question has been approved but not yet captured. The flaw arises from the plugin's failure to properly verify that a PayPal order in a payment request is linked to the correct WooCommerce order unless it is already completed, leading to potential unauthorized transactions.
Affected Version(s)
Payment Plugins for PayPal WooCommerce 0 < 2.0.27
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.