Unknown Payment Plugins For PayPal Woocommerce vulnerabilities

4 CVEs affecting Unknown Payment Plugins For PayPal Woocommerce, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-80342, published 2026-09-23.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-13399, published 2026-08-06. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.20 does not have proper authorization checks on a REST endpoint, allowing unauthenticated users to bypass payments
CVE-2026-80340, published 2026-09-09. Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days. The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.26 does not validate the order key before adding order data to the JavaScript configuration it outputs on the front end,…
CVE-2026-80341, published 2026-09-09. Medium severity, CVSS 5.9. EPSS: 0.2% chance of exploitation in the next 30 days. The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.26 does not verify that a stored payment method belongs to the user attaching it, allowing any authenticated user, such as a…
CVE-2026-80342, published 2026-09-23. Medium severity, CVSS 6.5. EPSS: 0.2% chance of exploitation in the next 30 days. The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.27 does not verify that a PayPal order supplied in a payment request belongs to the WooCommerce order being paid unless that…