Medium severity · published Sep 9, 2026
CVE-2026-80340
Payment Plugins for PayPal WooCommerce < 2.0.26 - Unauthenticated Customer PII Disclosure via order-pay
5.3
CVSS
0.3%
EPSS
No
On KEV
Description
The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.26 does not validate the order key before adding order data to the JavaScript configuration it outputs on the front end, allowing unauthenticated users to obtain the secret that gates access to any order and, through it, that customer's billing and shipping details, by iterating sequential order identifiers.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 28% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PP
Payment Plugins for PayPal WooCommerce ·
1.0.0 before 2.0.26 · source: vendor
Affected product
PP
Payment Plugins for PayPal WooCommerce
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-80340
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-80340
wpscan.com
https://wpscan.com/vulnerability/f8fb328e-1152-4122-8158-08fda66ec9c4/
More from Payment Plugins for PayPal WooCommerce
7.5
CVE-2026-13399
Payment Plugins for PayPal WooCommerce < 2.0.20 - Unauthenticated Payment Bypass via Reuse of a Completed PayPal Order
6.5
CVE-2026-80342
Payment Plugins for PayPal WooCommerce < 2.0.27 - Unauthenticated Payment Hijacking via Unvalidated PayPal Order ID
5.9
CVE-2026-80341
Payment Plugins for PayPal WooCommerce < 2.0.26 - Subscriber+ Stored Payment Method Assignment via IDOR