EUVD-2026-74705
GHSA-43fh-8hgg-2q9m
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Network-accessible, zero-auth, zero-interaction; confidentiality limited to per-order PII (C:L); no integrity or availability impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.26 does not validate the order key before adding order data to the JavaScript configuration it outputs on the front end, allowing unauthenticated users to obtain the secret that gates access to any order and, through it, that customer's billing and shipping details, by iterating sequential order identifiers.
AnalysisAI
Unauthenticated order data exposure in the Payment Plugins for PayPal WooCommerce WordPress plugin before version 2.0.26 allows remote attackers to harvest customer PII from any WooCommerce order. The plugin outputs order secrets into frontend JavaScript configuration without first validating the supplied order key, and because WooCommerce order identifiers are sequential integers, an attacker can iterate through IDs to retrieve the secret for each order and subsequently access that customer's billing address, shipping address, and associated personal details. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No authentication or account is required - exploitation is fully unauthenticated against any publicly reachable WooCommerce storefront running an affected plugin version (1.0.0 through 2.0.25). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 5.3 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) accurately captures network-accessible, zero-authentication exploitation with low individual-request confidentiality impact, but the aggregate impact is meaningfully higher than the per-request score implies: because order IDs are sequential and the attack is rated Automatable by CISA SSVC, a single script can enumerate the entire order history of a store and exfiltrate every customer's billing and shipping PII in bulk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary fix is to upgrade the Payment Plugins for PayPal WooCommerce plugin to version 2.0.26 or later, which validates the order key before including order data in frontend JavaScript output. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
The Payment Plugins for PayPal WooCommerce WordPress plugin (versions 1.1.0 through 2.0.25) fails to verify that a store
Improper access control in Payment Plugins for PayPal WooCommerce up to version 2.0.13 permits remote unauthenticated at
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today