CVE-2026-13399: Unknown Payment Plugins For PayPal Woocommerce

High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days.

The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.20 does not have proper authorization checks on a REST endpoint, allowing unauthenticated users to bypass payments

Affected products

• Unknown Payment Plugins For PayPal Woocommerce: before 2.0.20 (fixed in 2.0.20)

Published 2026-08-06. Last modified 2026-08-26.