CVE-2026-13399

The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.20 does not have proper authorization checks on a REST endpoint, allowing unauthenticated users to bypass payments

Score

CVSS 3.1 7.5 High

Status

Deferred - contact@wpscan.com

Published

2026-08-06

Last modified

2026-08-07

Weaknesses

CWE-639, CWE-862

Affected products

• Payment Plugins For Paypal Woocommerce (Unknown)

References

• https://wpscan.com/vulnerability/6ae19ba0-26ba-4ffa-94e3-3fe32cedcae1/