Executive brief
The Payment Plugins for PayPal WooCommerce is a WordPress plugin that processes payments through PayPal for online stores. A flaw in the plugin allows any logged-in customer to associate another customer's stored payment card with their own account, then use it to make unauthorized charges or permanently delete the victim's saved card from the payment processor. Exploitation requires the attacker to know the internal identifier of the victim's stored card, which must be obtained from outside sources.
Technical details
This is an authorization bypass vulnerability (CWE-863) in the payment method assignment functionality. When an authenticated user adds a payment method via the "Add payment method" form, the plugin fails to verify that the PayPal vault token being attached actually belongs to the authenticated user. An attacker can supply another user's PayPal vault token ID and the plugin will retrieve and save that token to the attacker's account. The attack requires the attacker to be registered and logged in, and to know the victim's PayPal vault token ID (which is not exposed by the plugin by default, requiring out-of-band discovery). Once attached, the attacker can use the stored payment method to charge the victim's card or delete it from the merchant's PayPal vault. This ownership check does exist during checkout but is missing during the payment method addition flow.
Affected products
- Payment Plugins Payment Plugins for PayPal WooCommerce before 2.0.26
Timeline
- 2026-09-07: disclosed
- 2026-09-09: advisory
- 2026-09-09: patched: Fixed in version 2.0.26