EUVD-2026-54400
GHSA-p384-7c3j-gqm7
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Network vector and no auth required when guest checkout enabled; AC:H for mandatory pre-obtained valid PayPal token; I:H for complete payment integrity bypass; C and A not impacted.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Lifecycle Timeline
3DescriptionCVE.org
The Subscriptions for WooCommerce WordPress plugin before 2.0.1 does not validate the payment amount or bind the PayPal order token to the order being completed on the WooCommerce order-received flow: it captures a client-supplied token and marks the order paid whenever the capture status is COMPLETED, without comparing the captured amount to the order total. This allows an attacker (unauthenticated where guest checkout is enabled) to substitute an approved, uncaptured PayPal order token and have an expensive order marked paid without paying its price.
AnalysisAI
Payment integrity bypass in the Subscriptions for WooCommerce plugin (versions before 2.0.1) enables financial fraud by allowing substitution of an arbitrary approved PayPal order token during the WooCommerce order-received flow. The plugin captures a client-supplied token and marks any order paid solely based on a COMPLETED capture status, without verifying that the captured amount matches the order total or that the token belongs to the specific order. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The plugin must be using PayPal as the active payment gateway for WooCommerce, and the Subscriptions for WooCommerce plugin version must be below 2.0.1. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD CVSS 3.1 score of 5.9 (Medium) with vector AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N reflects that, while the attack is network-accessible and requires no authentication (when guest checkout is enabled), the attacker must independently possess a valid approved but uncaptured PayPal order token - raising attack complexity to High. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker creates a minimal PayPal order - for example, a one-cent transaction - through their own PayPal account and obtains the resulting approved-but-uncaptured order token. They then add expensive items (e.g., a high-value subscription product) to the WooCommerce store, proceed to checkout as a guest, and on the order-received page inject the pre-obtained PayPal token in place of the token that would correspond to the actual order value. … |
| Remediation | Update the Subscriptions for WooCommerce plugin to version 2.0.1 or later immediately, as this version introduces proper server-side validation binding the PayPal order token to the specific WooCommerce order and verifying the captured amount against the order total. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Remote code execution in Subscriptions for WooCommerce WordPress plugin (before 2.0.1) is reachable by any authenticated
Privilege escalation in the Subscriptions for WooCommerce WordPress plugin (versions up to and including 2.0.0) allows a
Insecure Direct Object Reference (IDOR) in the Subscriptions for WooCommerce WordPress plugin before 2.0.1 allows any au
Arbitrary plugin installation in the WP Swings Subscriptions for WooCommerce plugin (versions up to and including 2.0.0)
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today