CVE-2026-13399 — Payment Plugins for PayPal WooCommerce < 2.0.20 - Unauthenticated Payment Bypass via Reuse of a Completed PayPal Order

CVE-2026-13399

Payment Plugins for PayPal WooCommerce < 2.0.20 - Unauthenticated Payment Bypass via Reuse of a Completed PayPal Order PUBLISHED

Description (CNA)

The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.20 does not have proper authorization checks on a REST endpoint, allowing unauthenticated users to bypass payments

Affected (CNA)

Vendor / product	Versions
Unknown / Payment Plugins for PayPal WooCommerce	affected 0 before 2.0.20

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/6ae19ba0-26ba-4ffa-94e3-3fe32cedcae1/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.