anonhaven

CVE-2026-13399

HIGH CVSS 3.1: 7.5 EPSS 0.28%
Updated Aug 07, 2026
WordPress
Parameter Value
CVSS 7.5 (HIGH)
Affected Versions before 2.0.20
Type CWE-862 (Missing Authorization), CWE-639 (Authorization Bypass)
Vendor WordPress
Public PoC No

The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.20 does not have proper authorization checks on a REST endpoint, allowing unauthenticated users to bypass payments

Attack Parameters

Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed

Impact Assessment

Confidentiality
None
No data leak
Integrity
High
Complete data modification
Availability
None
No disruption

CVSS Vector v3.1

Weakness Type (CWE)

CWE-862 Missing Authorization
CWE-639 Authorization Bypass

References 1

https://wpscan.com/vulnerability/6ae19ba0-26ba-4ffa-94e3-3fe32cedcae1/
contact@wpscan.com
Share Post Share Share Share

Related Vulnerabilities

CVE-2026-18044

Unknown

3.7

CVE-2026-17008

Unknown

5.3

CVE-2026-16990

Unknown

5.3

CVE-2026-16747

Unknown

6.5

CVE-2026-16621

Unknown

5.3