CVE-2026-13399 affects the Payment Plugins for PayPal WooCommerce WordPress plugin prior to version 2.0.20. The vulnerability arises from missing authorization checks on a REST endpoint, which permits unauthenticated users to bypass payment authorization controls. This could lead to unauthorized payment operations being performed without proper user validation. The issue is categorized under CWE-862 (Missing Authorization) and CWE-639, indicating improper access control and authorization logic flaws. The CVSS 3.1 base score is 7.5, reflecting a network attack vector with low attack complexity, no privileges required, no user interaction, and a high impact on integrity but no impact on confidentiality or availability. There is no vendor advisory or patch information available at this time, and no known exploits have been reported in the wild.

The vulnerability allows unauthenticated attackers to bypass payment authorization checks, potentially enabling unauthorized payment transactions or manipulation of payment processes. While confidentiality and availability are not impacted, the integrity of payment operations is severely affected, which could lead to financial fraud or unauthorized payment actions within affected WooCommerce installations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the affected REST endpoints via other means such as web application firewalls or custom access controls. Monitor vendor channels for updates and apply patches promptly once available.