CVE-2026-80340: Payment Plugins for PayPal WooCommerce < 2.0.26 - Unauthenticated Customer PII Disclosure via order-pay
The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.26 does not validate the order key before adding order data to the JavaScript configuration it outputs on the front end, allowing unauthenticated users to obtain the secret that gates access to any order and, through it, that customer's billing and shipping details, by iterating sequential order identifiers.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Payment Plugins for PayPal WooCommerce (WordPress)to a version that resolves this vulnerability.Fixed in 2.0.26
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated remote user can exploit it. The attacker can iterate sequential order identifiers and does not need to know a valid order key in advance.
What information can be exposed?
The issue can disclose the secret used to gate access to an order. That secret can then be used to access the affected customer's billing and shipping details.
Which installations are affected?
Payment Plugins for PayPal WooCommerce versions before 2.0.26 are affected. The provided information does not identify any configuration requirement or mitigation other than using a version that is not before 2.0.26.