Medium severity · published Sep 9, 2026
CVE-2026-80341
Payment Plugins for PayPal WooCommerce < 2.0.26 - Subscriber+ Stored Payment Method Assignment via IDOR
5.9
CVSS
0.2%
EPSS
No
On KEV
Description
The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.26 does not verify that a stored payment method belongs to the user attaching it, allowing any authenticated user, such as a subscriber, to bind another customer's stored card to their own account and then charge or delete it.
Exploitation requires the attacker to already know the payment provider's identifier for the victim's stored method, which the Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.26 does not expose.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N
Attack vector
Network
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 13% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PP
Payment Plugins for PayPal WooCommerce ·
1.1.0 before 2.0.26 · source: vendor
Affected product
PP
Payment Plugins for PayPal WooCommerce
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-80341
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-80341
wpscan.com
https://wpscan.com/vulnerability/83dceac1-c203-4827-ad34-c3971557fb84/
More from Payment Plugins for PayPal WooCommerce
7.5
CVE-2026-13399
Payment Plugins for PayPal WooCommerce < 2.0.20 - Unauthenticated Payment Bypass via Reuse of a Completed PayPal Order
6.5
CVE-2026-80342
Payment Plugins for PayPal WooCommerce < 2.0.27 - Unauthenticated Payment Hijacking via Unvalidated PayPal Order ID
5.3
CVE-2026-80340
Payment Plugins for PayPal WooCommerce < 2.0.26 - Unauthenticated Customer PII Disclosure via order-pay