CVE-2026-80342
Payment Plugins for PayPal WooCommerce < 2.0.27 - Unauthenticated Payment Hijacking via Unvalidated PayPal Order ID
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.27 does not verify that a PayPal order supplied in a payment request belongs to the WooCommerce order being paid unless that PayPal order has already been completed, allowing unauthenticated attackers to have another buyer's approved but uncaptured payment captured against an order of their own.
| Vendor | unknown |
| Product | payment plugins for paypal woocommerce |
| Published | Sep 23, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown payment plugins for paypal woocommerce
Be the first to know when new unknown vulnerabilities affecting unknown payment plugins for paypal woocommerce are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Payment Plugins for PayPal WooCommerce
0 < 2.0.27
References
Credits
m1w34p0n & krypt3d WPScan