CVE-2026-39643

CVE-2026-39643 is a missing authorization vulnerability affecting the Payment Plugins for PayPal WooCommerce plugin (pymntpl-paypal-woocommerce) through version 2.0.13. The flaw stems from incorrectly configured access control security levels that could allow unauthorized actions within the payment processing system. This vulnerability impacts WooCommerce implementations relying on the affected plugin versions for PayPal payment processing. The vulnerability carries a CVSS score of 5.3 (Medium severity) with a network-based attack vector requiring no privileges or user interaction, making it relatively straightforward to exploit. However, the impact is limited to integrity violations with no confidentiality or availability consequences. The EPSS score of 0.00037 indicates minimal real-world exploitation activity relative to other CVEs. There is currently no evidence of active exploitation or public exploit code availability. The vulnerability is not listed on the CISA KEV catalog and remains categorized as inactive on threat intelligence platforms. While the FAUCET risk score of 32.0/100 suggests moderate concern, the low EPSS and absence of exploitation indicators suggest limited immediate threat, though organizations using affected plugin versions should prioritize patching to mitigate authorization bypass risks.