WordPress Plugin Vulnerabilities

Payment Plugins for PayPal WooCommerce < 2.0.27 - Unauthenticated Payment Hijacking via Unvalidated PayPal Order ID

Description

The plugin does not verify that a PayPal order supplied in a payment request belongs to the WooCommerce order being paid unless that PayPal order has already been completed, allowing unauthenticated attackers to have another buyer's approved but uncaptured payment captured against an order of their own.

Proof of Concept

Affects Plugins

Plugin icon
pymntpl-paypal-woocommerce
Fixed in 2.0.27

References

CVE
CVE-2026-80342

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
6.5 (medium)

Miscellaneous

Original Researcher
m1w34p0n & krypt3d
Submitter
m1w34p0n
Verified
Yes
WPVDB ID
5c3eea0d-7f7f-48e5-8f78-c553b3fdeabf

Timeline

Publicly Published
2026-09-21 (about 2 days ago)
Added
2026-09-21 (about 1 day ago)
Last Updated
2026-09-21 (about 1 day ago)

Other

Published
Title
Published
2026-07-08
Title
Easy Appointments < 3.12.28 - Subscriber+ Cross-User Appointment Data Modification via IDOR
Published
2026-07-30
Title
Fluent Forms < 6.2.9 - Unauthenticated Payment Receipt Disclosure via IDOR
Published
2025-02-21
Title
Post Grid and Gutenberg Blocks < 2.3.6 - Unauthenticated Paid Order Creation
Published
2024-06-18
Title
Replace Image < 1.1.11 - Insecure Direct Object Reference
Published
2026-04-14
Title
Avada (Fusion) Builder < 3.15.2 - Authenticated (Subscriber+) Sensitive Information Exposure via Insecure Direct Object Reference