CVE-2026-80340: PayPal WooCommerce Information Disclosure

CVE-2026-80340 Overview

CVE-2026-80340 affects the Payment Plugins for PayPal WooCommerce WordPress plugin in versions prior to 2.0.26. The plugin embeds order data into JavaScript configuration served on the front end without validating the order key. Unauthenticated attackers can iterate sequential order identifiers and retrieve the secret that gates access to any order. Once obtained, that secret exposes the associated customer's billing and shipping details. The weakness is classified as an Information Exposure issue [CWE-200].

Critical Impact
Unauthenticated remote attackers can enumerate order identifiers to harvest customer billing and shipping information from any WooCommerce store running a vulnerable version of the plugin.

Affected Products

Payment Plugins for PayPal WooCommerce WordPress plugin, versions before 2.0.26
WordPress sites running WooCommerce with the affected plugin installed
Storefronts exposing order data through the plugin's front-end JavaScript configuration

Discovery Timeline

2026-09-09 - CVE-2026-80340 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-80340

Vulnerability Analysis

The plugin outputs order-related data into a JavaScript configuration object rendered on the front end. Before doing so, it fails to validate the order key that should authorize access to a specific order. An unauthenticated visitor can request order-related endpoints using sequentially incremented order identifiers. The response reveals the per-order secret intended to serve as an access token. With that secret, the attacker retrieves the full billing and shipping details linked to each order. The issue is a business logic and access control gap classified under [CWE-200] Information Exposure.

Root Cause

The root cause is missing verification of the order key parameter before the plugin serializes order data into the JavaScript configuration. The plugin trusts the order identifier alone and does not confirm that the requester possesses the associated secret. This design defect allows the secret itself, which acts as the authorization primitive, to leak to anyone who can guess or enumerate order IDs.

Attack Vector

Exploitation requires only network access to the storefront. An attacker scripts requests that increment the order identifier and parses the returned JavaScript configuration to extract the secret. Using the secret, the attacker requests each order's detail view and collects the customer's personal information. No authentication, user interaction, or elevated privileges are required.

No public proof-of-concept code has been verified. See the WPScan Vulnerability Report for technical details.

Detection Methods for CVE-2026-80340

Indicators of Compromise

Sequential or rapid HTTP requests referencing incrementing WooCommerce order identifiers from a single client
Unauthenticated requests to the plugin's front-end endpoints returning JavaScript payloads containing order keys
Anomalous scraping patterns targeting order-received or checkout confirmation URLs

Detection Strategies

Review web server access logs for enumeration patterns against order endpoints and pages tied to the PayPal plugin
Alert on high request rates from single source IPs querying order-scoped URLs without prior session activity
Correlate unauthenticated traffic hitting checkout confirmation routes with responses containing serialized order metadata

Monitoring Recommendations

Enable verbose logging on the WooCommerce checkout and order-received flows
Deploy a web application firewall rule to flag sequential order identifier access from unauthenticated clients
Monitor outbound data volumes from the storefront for unusual bursts consistent with automated scraping

How to Mitigate CVE-2026-80340

Immediate Actions Required

Upgrade the Payment Plugins for PayPal WooCommerce plugin to version 2.0.26 or later
Audit web server logs for order enumeration activity dating back to the plugin's installation
Notify affected customers if evidence indicates their billing or shipping data was accessed

Patch Information

The vendor has released version 2.0.26, which adds validation of the order key before order data is added to the JavaScript configuration. Site administrators should apply the update through the WordPress plugin manager. Additional details are available in the WPScan Vulnerability Report.

Workarounds

Temporarily deactivate the Payment Plugins for PayPal WooCommerce plugin until the upgrade is applied
Place a web application firewall rule in front of the site to block unauthenticated enumeration of order identifiers
Restrict access to order-related endpoints by IP or session token where feasible

bash

# Update the plugin using WP-CLI
wp plugin update woo-paypal-gateway --version=2.0.26

# Verify the installed version
wp plugin get woo-paypal-gateway --field=version