EUVD-2026-54180
GHSA-frpp-mq58-xvp7
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Network-accessible unauthenticated REST endpoint requires no privileges or interaction; integrity-only impact as payment bypass enables fraudulent orders without exposing data or disrupting availability.
Primary rating from Vendor (wpscan).
CVSS VectorVendor: wpscan
Lifecycle Timeline
3DescriptionCVE.org
The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.20 does not have proper authorization checks on a REST endpoint, allowing unauthenticated users to bypass payments
AnalysisAI
Payment bypass in the Payment Plugins for PayPal WooCommerce WordPress plugin (versions before 2.0.20) allows unauthenticated attackers to complete purchases without initiating an actual PayPal payment transaction. A missing authorization check on a REST endpoint means any unauthenticated HTTP client can trigger order completion, resulting in goods or services being fulfilled with no payment collected. No public exploit has been identified at time of analysis, but the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms the attack is trivially automatable against any internet-facing WooCommerce store running the affected plugin.
Technical ContextAI
The vulnerability resides in a WordPress REST API endpoint registered by the Payment Plugins for PayPal WooCommerce plugin, which handles PayPal payment processing within WooCommerce stores. WordPress REST API endpoints require explicit capability or permission checks via a 'permission_callback' function; omitting this check means the WordPress authentication and authorization layer is entirely bypassed. Although no CWE was formally assigned in the provided data, this flaw is characteristic of CWE-862 (Missing Authorization) or CWE-285 (Improper Authorization). All plugin versions prior to 2.0.20 expose this unauthenticated REST endpoint. No CPE string was included in the available data; the plugin is identified in the WordPress ecosystem as the 'payment-plugins-paypal-woocommerce' package.
RemediationAI
Update the Payment Plugins for PayPal WooCommerce plugin to version 2.0.20 or later, which introduces proper authorization enforcement on the affected REST endpoint. Updates can be applied via the WordPress admin Plugins dashboard or via WP-CLI using 'wp plugin update payment-plugins-paypal-woocommerce'. Until patching is feasible, site operators should consider temporarily disabling the plugin if PayPal payment capability can be suspended - note this will interrupt all PayPal transactions. Alternatively, a web application firewall rule can be configured to block unauthenticated POST requests to WordPress REST API routes associated with this plugin; however, the exact endpoint path is not disclosed in available data and would need to be identified from plugin source code or the full WPScan advisory at https://wpscan.com/vulnerability/6ae19ba0-26ba-4ffa-94e3-3fe32cedcae1/. Restricting WordPress REST API access globally is not recommended as it would break legitimate site functionality.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today