Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.5
CVE-2026-80342: Payment Plugins for PayPal WooCommerce lets attackers capture payments
CVE-2026-80342 · published 1 month ago
Summary
The PayPal payment plugin for WooCommerce (versions before 2.0.27) does not check that a PayPal order ID belongs to the specific shopping cart order. Because of this, a stranger could take a payment that was approved for another customer and apply it to their own order, stealing the money. Update the plugin to version 2.0.27 or later, or remove the plugin if you cannot upgrade.
What to do
- Update unknown payment plugins for paypal woocommerce to version 2.0.27 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| unknown | payment plugins for paypal woocommerce | < 2.0.27 |
Original advisory text
Payment Plugins for PayPal WooCommerce < 2.0.27 - Unauthenticated Payment Hijacking via Unvalidated PayPal Order ID
The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.27 does not verify that a PayPal order supplied in a payment request belongs to the WooCommerce order being paid unless that PayPal order has already been completed, allowing unauthenticated attackers to have another buyer's approved but uncaptured payment captured against an order of their own.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
6.5
Medium
Type
CWE-639Authorization Bypass Through User-Controlled Key
Timeline
Published23 Sep 2026
Updated4 Nov 2026
First seen23 Sep 2026
Track software like this
Free during beta