Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,007 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Plugin · pymntpl-paypal-woocommerce
Payment Plugins for PayPal WooCommerce
5 known vulnerabilities on record. Add your version above to see which ones affect you.
Is Payment Plugins for PayPal WooCommerce safe? The full page →
Sep 23, 2026Payment Plugins for PayPal WooCommerce: Does not verify that a PayPal order supplied in a payment request belongs to the WooCommerce order being paid unless that PayPal order has already been completedCVE-2026-80342 · fixed in 2.0.27 · reported by WPScanMedium 6.5
The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.27 does not verify that a PayPal order supplied in a payment request belongs to the WooCommerce order being paid unless that PayPal order has already been completed, allowing unauthenticated attackers to have another buyer's approved but uncaptured payment captured against an order of their own.
Sep 9, 2026Payment Plugins for PayPal WooCommerce: Does not verify that a stored payment method belongs to the user attaching itCVE-2026-80341 · fixed in 2.0.26 · reported by WPScanMedium 5.9
The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.26 does not verify that a stored payment method belongs to the user attaching it, allowing any authenticated user, such as a subscriber, to bind another customer's stored card to their own account and then charge or delete it. Exploitation requires the attacker to already know the payment provider's identifier for the victim's stored method, which the Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.26 does not expose.
Sep 9, 2026Payment Plugins for PayPal WooCommerce: Does not validate the order key before adding order data to the JavaScript configuration it outputs on the front endCVE-2026-80340 · fixed in 2.0.26 · reported by WPScanMedium 5.3
The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.26 does not validate the order key before adding order data to the JavaScript configuration it outputs on the front end, allowing unauthenticated users to obtain the secret that gates access to any order and, through it, that customer's billing and shipping details, by iterating sequential order identifiers.
Aug 6, 2026Payment Plugins for PayPal WooCommerce: Does not have proper authorization checks on a REST endpointCVE-2026-13399 · fixed in 2.0.20 · reported by WPScanHigh 7.5
The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.20 does not have proper authorization checks on a REST endpoint, allowing unauthenticated users to bypass payments
Apr 8, 2026Payment Plugins for PayPal WooCommerce: Missing AuthorizationCVE-2026-39643 · affects up to 2.0.13 · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Payment Plugins Payment Plugins for PayPal WooCommerce pymntpl-paypal-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Payment Plugins for PayPal WooCommerce: from n/a through <= 2.0.13.
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.