CVE-2026-80341 is an incorrect authorization vulnerability (CWE-863) in the Payment Plugins for PayPal WooCommerce WordPress plugin prior to version 2.0.26. The flaw allows any authenticated user, including low-privileged roles such as subscribers, to attach another customer's stored payment method to their own account without proper verification. This could enable unauthorized charging or deletion of the victim's stored payment methods. However, exploitation requires the attacker to already know the payment provider's identifier for the victim's stored method, which is not exposed by the plugin. There is no CVSS score or vendor advisory indicating a fix or mitigation at this time.

An attacker with an authenticated account on the affected WordPress site can potentially misuse another customer's stored payment method by binding it to their own account and performing unauthorized charges or deletions. The risk is limited by the requirement that the attacker must know the payment provider's identifier for the victim's stored payment method, which is not publicly exposed by the plugin. There is no evidence of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user roles and permissions to minimize the risk of unauthorized access. Monitor for updates from the plugin vendor and apply patches promptly once available.