CVE-2026-80341: Payment Plugins for PayPal WooCommerce authorization bypass in payment method assignment

CVE-2026-80341 · Severity: medium · CVSS 5.9 · Published 2026-09-09

The Payment Plugins for PayPal WooCommerce is a WordPress plugin that processes payments through PayPal for online stores. A flaw in the plugin allows any logged-in customer to associate another customer's stored payment card with their own account, then use it to make unauthorized charges or permanently delete the victim's saved card from the payment processor. Exploitation requires the attacker to know the internal identifier of the victim's stored card, which must be obtained from outside sources.

Technologies: Payment Plugins for PayPal WooCommerce. Vendors: Payment Plugins.

Quick answers

Is CVE-2026-80341 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-80341 being exploited in the wild.
How severe is CVE-2026-80341?
Medium severity, with a CVSS score of 5.9, published 9 September 2026.
Which products and versions are affected?
Payment Plugins for PayPal WooCommerce before 2.0.26.
Is there a fix for CVE-2026-80341?
A patch was published on 2026-09-09: Fixed in version 2.0.26 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-80341 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-80341?
Check whether you run Payment Plugins for PayPal WooCommerce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is an authorization bypass vulnerability (CWE-863) in the payment method assignment functionality. When an authenticated user adds a payment method via the "Add payment method" form, the plugin fails to verify that the PayPal vault token being attached actually belongs to the authenticated user. An attacker can supply another user's PayPal vault token ID and the plugin will retrieve and save that token to the attacker's account. The attack requires the attacker to be registered and logged in, and to know the victim's PayPal vault token ID (which is not exposed by the plugin by default, requiring out-of-band discovery). Once attached, the attacker can use the stored payment method to charge the victim's card or delete it from the merchant's PayPal vault. This ownership check does exist during checkout but is missing during the payment method addition flow.

Affected products

  • Payment Plugins Payment Plugins for PayPal WooCommerce before 2.0.26

Timeline

  • 2026-09-07: disclosed
  • 2026-09-09: advisory
  • 2026-09-09: patched: Fixed in version 2.0.26

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.