What is the CVSS score of CVE-2026-39643?

CVE-2026-39643 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Payment Plugins For Paypal Woocommerce CVE-2026-39643

EUVD-2026-20302 MEDIUM

Missing Authorization (CWE-862)

2026-04-08 Patchstack

GHSA-9355-239h-5rwf

WordPress Authentication Bypass Payment Plugins For Paypal Woocommerce Wordpress Plugin

5.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Primary rating from Vendor (Patchstack) · only source for this CVE.

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 15, 2026 - 12:42 vuln.today

CVSS changed

Apr 13, 2026 - 19:37 NVD

5.3 (MEDIUM)

EUVD ID Assigned

Apr 08, 2026 - 08:45 euvd

EUVD-2026-20302

CVE Published

Apr 08, 2026 - 08:30 nvd

N/A

DescriptionCVE.org

Missing Authorization vulnerability in Payment Plugins Payment Plugins for PayPal WooCommerce pymntpl-paypal-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Payment Plugins for PayPal WooCommerce: from n/a through <= 2.0.13.

AnalysisAI

Improper access control in Payment Plugins for PayPal WooCommerce up to version 2.0.13 permits remote unauthenticated attackers to modify sensitive data through incorrectly configured authorization checks. The vulnerability (CVSS 5.3) allows integrity violations in payment-related operations via network requests without authentication or user interaction. With an EPSS score of 0.02%, exploitation likelihood remains minimal in measured threat activity, though the CWE-862 (missing authorization) classification indicates a fundamental security control failure in the plugin's privilege validation.

Technical ContextAI

The vulnerability stems from CWE-862 (Missing Authorization), a class of flaws where the application fails to verify that users possess the necessary privileges before executing sensitive operations. In the context of the Payment Plugins for PayPal WooCommerce plugin (identified via CPE cpe:2.3:a:payment_plugins:payment_plugins_for_paypal_woocommerce:*:*:*:*:*:*:*:*), this manifests as broken access control within WordPress plugin architecture. WordPress plugins execute within the wp_ajax_ hook system and REST API handlers; missing nonces, capability checks (via current_user_can()), or improperly scoped user role validation allows unauthenticated or low-privilege users to invoke administrative functions. The CVSS vector AV:N/AC:L/PR:N indicates the flaw is exploitable remotely over the network with low complexity and no prior authentication, typical of WordPress admin-ajax endpoints that lack proper permission validation before processing payment-related requests.

RemediationAI

Upgrade Payment Plugins for PayPal WooCommerce to version 2.0.14 or later, which provides the authorization control fixes. The patch is available from the official WordPress plugin repository and vendor (payment-plugins.com). To verify installation, navigate to WordPress Plugins dashboard and confirm the plugin version post-update. No interim workarounds mitigate the missing authorization; patching is the definitive remediation. Reference the advisory at https://nvd.nist.gov/vuln/detail/CVE-2026-39643 and Patchstack database for patch confirmation and deployment guidance.