Information disclosure in Payment Plugins For Paypal Woocommerce
CVE-2026-80340
The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.26 does not validate the order key before adding order data to the JavaScript configuration it outputs on the front end, allowing unauthenticated users to obtain the secret that gates access to any order and, through it, that customer's billing and shipping details, by iterating sequential order identifiers.
Vulnerability class: Information Disclosure
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.
Affected products
- Unknown Payment Plugins For Paypal Woocommerce
Weakness classification (CWE)
References
- contact@wpscan.com (technical-description, exploit, vdb-entry)
Frequently asked questions
- What is CVE-2026-80340?
- CVE-2026-80340 is a medium-severity vulnerability in Payment Plugins For Paypal Woocommerce, classified under Information Disclosure. CVSS score: 5.3/10. Published 2026-09-09.
- How severe is CVE-2026-80340?
- Medium severity. CVSS v3 base score is 5.3 out of 10.