https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 22:47:22 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-80341 <p>The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.26 does not verify that a stored payment method belongs to the user attaching it, allowing any authenticated user, such as a subscriber, to bind another customer&#39;s stored card to their own account and then charge or delete it. Exploitation requires the attacker to already know the payment provider&#39;s identifier for the victim&#39;s stored method, which the Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.26 does not expose.</p> <p>The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.26 does not verify that a stored payment method belongs to the user attaching it, allowing any authenticated user, such as a subscriber, to bind another customer&#39;s stored card to their own account and then charge or delete it. Exploitation requires the attacker to already know the payment provider&#39;s identifier for the victim&#39;s stored method, which the Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.26 does not expose.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-80341 https://vulnerability.circl.lu/vuln/ghsa-7838-p44c-rv6w <p>The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.26 does not verify that a stored payment method belongs to the user attaching it, allowing any authenticated user, such as a subscriber, to bind another customer&#39;s stored card to their own account and then charge or delete it. Exploitation requires the attacker to already know the payment provider&#39;s identifier for the victim&#39;s stored method, which the Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.26 does not expose.</p> <p>The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.26 does not verify that a stored payment method belongs to the user attaching it, allowing any authenticated user, such as a subscriber, to bind another customer&#39;s stored card to their own account and then charge or delete it. Exploitation requires the attacker to already know the payment provider&#39;s identifier for the victim&#39;s stored method, which the Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.26 does not expose.</p> https://vulnerability.circl.lu/vuln/ghsa-7838-p44c-rv6w