Medium severity · published Sep 23, 2026
CVE-2026-80342
Payment Plugins for PayPal WooCommerce < 2.0.27 - Unauthenticated Payment Hijacking via Unvalidated PayPal Order ID
6.5
CVSS
0.3%
EPSS
No
On KEV
Description
The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.27 does not verify that a PayPal order supplied in a payment request belongs to the WooCommerce order being paid unless that PayPal order has already been completed, allowing unauthenticated attackers to have another buyer's approved but uncaptured payment captured against an order of their own.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 19% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PP
Payment Plugins for PayPal WooCommerce ·
before 2.0.27 · source: vendor
Affected product
PP
Payment Plugins for PayPal WooCommerce
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-80342
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-80342
wpscan.com
https://wpscan.com/vulnerability/5c3eea0d-7f7f-48e5-8f78-c553b3fdeabf/
More from Payment Plugins for PayPal WooCommerce
7.5
CVE-2026-13399
Payment Plugins for PayPal WooCommerce < 2.0.20 - Unauthenticated Payment Bypass via Reuse of a Completed PayPal Order
5.9
CVE-2026-80341
Payment Plugins for PayPal WooCommerce < 2.0.26 - Subscriber+ Stored Payment Method Assignment via IDOR
5.3
CVE-2026-80340
Payment Plugins for PayPal WooCommerce < 2.0.26 - Unauthenticated Customer PII Disclosure via order-pay