CVE-2026-80341: Payment Plugins for PayPal WooCommerce < 2.0.26 - Subscriber+ Stored Payment Method Assignment via IDOR
The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.26 does not verify that a stored payment method belongs to the user attaching it, allowing any authenticated user, such as a subscriber, to bind another customer's stored card to their own account and then charge or delete it. Exploitation requires the attacker to already know the payment provider's identifier for the victim's stored method, which the Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.26 does not expose.
Affected Software
Event History
Frequently Asked Questions
Which users can exploit this issue?
Any authenticated WordPress user can exploit it, including users with only the Subscriber role. The attacker must also know the payment provider identifier for another customer's stored payment method.
Are stored payment-method identifiers exposed by the affected plugin?
No. The affected plugin does not expose these identifiers, so exploitation depends on the attacker obtaining a victim's identifier through another source.
What could an attacker do after attaching a victim's payment method?
They can bind the victim's stored card to their own account, then charge it or delete it.
Which plugin versions are affected?
Versions of Payment Plugins for PayPal WooCommerce before 2.0.26 are affected.