CVE-2026-80342

MEDIUMCVSS 6.5

Description

The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.27 does not verify that a PayPal order supplied in a payment request belongs to the WooCommerce order being paid unless that PayPal order has already been completed, allowing unauthenticated attackers to have another buyer's approved but uncaptured payment captured against an order of their own.

Timeline

Published:September 23rd, 2026 6:17 AM

Last modified:September 23rd, 2026 6:13 PM

CVSS Scoring

CVSS v3: 6.5 (MEDIUM)

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N

Weaknesses (CWE)

CWE-639

References & Reports

Advisories, patches, and third-party reports

https://wpscan.com/vulnerability/5c3eea0d-7f7f-48e5-8f78-c553b3fdeabf/

Source: NIST NVD · Data may lag official sources by up to one minute