CVE-2026-80341: PayPal WooCommerce Payment Authorization Bypass

CVE-2026-80341 Overview

CVE-2026-80341 affects the Payment Plugins for PayPal WooCommerce WordPress plugin in versions before 2.0.26. The plugin fails to verify that a stored payment method belongs to the user attaching it to an account. An authenticated user with subscriber-level privileges can bind another customer's stored card to their own account, then charge or delete it. Exploitation requires the attacker to already know the payment provider's identifier for the victim's stored payment method. The plugin itself does not expose that identifier, which raises the attack complexity. The weakness is classified as an authorization flaw [CWE-863].

Critical Impact
An authenticated low-privilege user can attach, charge, or delete another customer's stored payment card if they obtain the provider-side payment method identifier.

Affected Products

Payment Plugins for PayPal WooCommerce WordPress plugin versions before 2.0.26
WordPress sites running WooCommerce with the affected plugin installed
E-commerce environments that allow customer account registration (subscriber role)

Discovery Timeline

2026-09-09 - CVE-2026-80341 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-80341

Vulnerability Analysis

The vulnerability is a broken access control issue in the plugin's stored payment method handling. When a user attaches a stored card to their account, the plugin accepts the provider-side payment method identifier without verifying that the identifier corresponds to a payment method owned by the requesting user. Once the card is bound to the attacker's account, standard account operations such as charging or deleting the payment method succeed against a victim's card. The scope is limited by the requirement that the attacker must already possess the payment provider's identifier for the target's stored method, which the plugin does not disclose.

Root Cause

The root cause is missing authorization enforcement on the payment method attachment endpoint. The plugin trusts client-supplied identifiers instead of validating ownership against the authenticated session. This maps directly to [CWE-863: Incorrect Authorization].

Attack Vector

Exploitation occurs over the network against an authenticated session. Any registered user, including a subscriber, can invoke the affected functionality. The attacker must know or obtain the payment provider's identifier for the victim's stored payment method through an out-of-band source. With that identifier, the attacker attaches the card to their own account and can then trigger a charge or a deletion. Technical details are available in the WPScan Vulnerability Report.

Detection Methods for CVE-2026-80341

Indicators of Compromise

Unexpected additions of stored payment methods to user accounts that do not match the account holder's billing history
WooCommerce order or refund events tied to payment tokens that were recently reassigned between customer accounts
Deletion events for stored payment methods initiated by users other than the original card owner
Support tickets from customers reporting missing or unauthorized charges against saved cards

Detection Strategies

Review plugin request logs for calls to the payment method attachment endpoint originating from low-privilege accounts
Correlate payment token identifiers across user accounts to identify tokens that appear under multiple user_id values
Compare stored payment method ownership records in the WooCommerce database against payment provider records

Monitoring Recommendations

Enable web server access logging for all plugin endpoints and forward logs to a centralized analytics platform
Alert on any HTTP request from a subscriber-role session that modifies stored payment method associations
Monitor PayPal or provider dashboards for charge or refund activity that does not correlate to the expected account holder

How to Mitigate CVE-2026-80341

Immediate Actions Required

Update the Payment Plugins for PayPal WooCommerce plugin to version 2.0.26 or later on all WordPress sites
Audit stored payment method assignments in the WooCommerce database for anomalies
Review recent orders and refund activity for unauthorized charges tied to reassigned payment tokens
Notify affected customers if evidence of unauthorized payment method reassignment is found

Patch Information

The vendor addressed the issue in version 2.0.26 of the Payment Plugins for PayPal WooCommerce WordPress plugin. Site administrators should upgrade through the WordPress plugin manager or by deploying the updated plugin package. Refer to the WPScan Vulnerability Report for advisory details.

Workarounds

Disable the Payment Plugins for PayPal WooCommerce plugin until the update to 2.0.26 can be applied
Restrict new account registrations or require administrator approval for new customer accounts
Temporarily disable the stored payment methods feature in WooCommerce settings to prevent card reuse
Rotate or invalidate stored payment tokens in the payment provider dashboard if unauthorized reassignment is suspected

bash

# Configuration example: update the plugin via WP-CLI
wp plugin update woo-paypal-gateway --version=2.0.26
wp plugin list --name=woo-paypal-gateway --fields=name,status,version