Payment Plugins For Paypal Woocommerce
Approved changes feed: RSS · Atom
cpe:2.3:a:unknown:payment_plugins_for_paypal_woocommerce:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Unknown (668ca391-a6cc-5e33-879b-83885214de33) |
|---|---|
| Product | Payment Plugins For Paypal Woocommerce (fef0e274-c535-5402-9173-afe48a34f30b) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-13399 |
vulnerable | 2026-09-16 04:32:50.414323 |
Payment Plugins for PayPal WooCommerce < 2.0.20 - Unauthenticated Payment Bypass via Reuse of a Completed PayPal Order
HIGH (7.5)
The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.20 does not have proper authorization checks on a REST endpoint, allowing unauthenticated users to bypass payments
Published: 2026-08-06T16:52:35.502Z
Updated: 2026-08-07T13:59:41.902Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-80340 |
vulnerable | 2026-09-16 04:32:40.199902 |
Payment Plugins for PayPal WooCommerce < 2.0.26 - Unauthenticated Customer PII Disclosure via order-pay
The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.26 does not validate the order key before adding order data to the JavaScript configuration it outputs on the front end, allowing unauthenticated users to obtain the secret that gates access to any order and, through it, that customer's billing and shipping details, by iterating sequential order identifiers.
Published: 2026-09-09T06:00:05.797Z
Updated: 2026-09-09T15:39:35.900Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-80341 |
vulnerable | 2026-09-16 04:32:40.149034 |
Payment Plugins for PayPal WooCommerce < 2.0.26 - Subscriber+ Stored Payment Method Assignment via IDOR
The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.26 does not verify that a stored payment method belongs to the user attaching it, allowing any authenticated user, such as a subscriber, to bind another customer's stored card to their own account and then charge or delete it.
Exploitation requires the attacker to already know the payment provider's identifier for the victim's stored method, which the Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.26 does not expose.
Published: 2026-09-09T06:00:05.974Z
Updated: 2026-09-09T15:39:21.517Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.