Payment Plugins For Paypal Woocommerce
Monthly
The Payment Plugins for PayPal WooCommerce WordPress plugin (versions 1.1.0 through 2.0.25) fails to verify that a stored PayPal vault payment method token belongs to the authenticated user requesting to attach it, allowing any subscriber-level account holder to claim ownership of another customer's vaulted card. Once bound to the attacker's account, the victim's stored payment method can be charged fraudulently or permanently deleted. A publicly available proof-of-concept exists per WPScan, though EPSS (0.13%, 3rd percentile) and SSVC exploitation status 'none' indicate no widespread active exploitation at time of analysis.
Unauthenticated order data exposure in the Payment Plugins for PayPal WooCommerce WordPress plugin before version 2.0.26 allows remote attackers to harvest customer PII from any WooCommerce order. The plugin outputs order secrets into frontend JavaScript configuration without first validating the supplied order key, and because WooCommerce order identifiers are sequential integers, an attacker can iterate through IDs to retrieve the secret for each order and subsequently access that customer's billing address, shipping address, and associated personal details. A publicly available proof-of-concept exists; no active exploitation is confirmed by CISA KEV at time of analysis.
Improper access control in Payment Plugins for PayPal WooCommerce up to version 2.0.13 permits remote unauthenticated attackers to modify sensitive data through incorrectly configured authorization checks. The vulnerability (CVSS 5.3) allows integrity violations in payment-related operations via network requests without authentication or user interaction. With an EPSS score of 0.02%, exploitation likelihood remains minimal in measured threat activity, though the CWE-862 (missing authorization) classification indicates a fundamental security control failure in the plugin's privilege validation.
The Payment Plugins for PayPal WooCommerce WordPress plugin (versions 1.1.0 through 2.0.25) fails to verify that a stored PayPal vault payment method token belongs to the authenticated user requesting to attach it, allowing any subscriber-level account holder to claim ownership of another customer's vaulted card. Once bound to the attacker's account, the victim's stored payment method can be charged fraudulently or permanently deleted. A publicly available proof-of-concept exists per WPScan, though EPSS (0.13%, 3rd percentile) and SSVC exploitation status 'none' indicate no widespread active exploitation at time of analysis.
Unauthenticated order data exposure in the Payment Plugins for PayPal WooCommerce WordPress plugin before version 2.0.26 allows remote attackers to harvest customer PII from any WooCommerce order. The plugin outputs order secrets into frontend JavaScript configuration without first validating the supplied order key, and because WooCommerce order identifiers are sequential integers, an attacker can iterate through IDs to retrieve the secret for each order and subsequently access that customer's billing address, shipping address, and associated personal details. A publicly available proof-of-concept exists; no active exploitation is confirmed by CISA KEV at time of analysis.
Improper access control in Payment Plugins for PayPal WooCommerce up to version 2.0.13 permits remote unauthenticated attackers to modify sensitive data through incorrectly configured authorization checks. The vulnerability (CVSS 5.3) allows integrity violations in payment-related operations via network requests without authentication or user interaction. With an EPSS score of 0.02%, exploitation likelihood remains minimal in measured threat activity, though the CWE-862 (missing authorization) classification indicates a fundamental security control failure in the plugin's privilege validation.