EUVD-2026-57173
GHSA-g8f7-gp6h-9f2x
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Network-accessible with no privileges or user interaction required; integrity impact is High because arbitrary orders can be fraudulently completed, enabling systematic theft of goods or services.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
3DescriptionCVE.org
The Payment Gateway for PayPal on WooCommerce WordPress plugin before 9.2.1 does not verify that payment actually succeeded before completing an order in its PayPal return handler: it reads attacker-controlled parameters, performs no amount comparison and no order-ownership check, and completes the order even when the server-side gateway verification fails, allowing an unauthenticated attacker to mark arbitrary orders as paid without paying.
AnalysisAI
Payment fraud in the Payment Gateway for PayPal on WooCommerce WordPress plugin (all versions before 9.2.1) enables unauthenticated remote attackers to mark arbitrary WooCommerce orders as paid without completing actual payment. The plugin's PayPal return handler reads attacker-controlled URL parameters and completes orders regardless of whether server-side gateway verification passes or fails, with no amount comparison and no order-ownership validation. A publicly available proof-of-concept exploit exists per WPScan; while the official CVSS score is 5.3, the financial fraud impact on affected e-commerce stores is materially higher in practice.
Technical ContextAI
The affected plugin implements a PayPal return handler - a URL endpoint that PayPal redirects customers to after a payment attempt. A correct implementation verifies payment server-side via PayPal's IPN (Instant Payment Notification) or the Orders API before fulfilling any order. In all versions prior to 9.2.1 (CPE: cpe:2.3:a:unknown:payment_gateway_for_paypal_on_woocommerce:*:*:*:*:*:*:*:*), this handler instead reads order-identifying parameters directly from the attacker-controlled HTTP request, performs no comparison of the charged amount against the order total, applies no order-ownership check to bind the session to the order, and ignores a failed gateway verification result - completing the order regardless. No CWE was formally assigned, but CWE-345 (Insufficient Verification of Data Authenticity) and CWE-602 (Client-Side Enforcement of Server-Side Security) closely describe this business logic root cause. The tag 'Information Disclosure' present in the source intelligence appears to be a mislabel; the actual impact is unauthorized integrity modification of order state.
RemediationAI
Update the Payment Gateway for PayPal on WooCommerce plugin to version 9.2.1 or later, the vendor-released patched version confirmed by WPScan advisory https://wpscan.com/vulnerability/76c4cff2-1166-45fe-9517-5eda2d24c35d/. If immediate patching is not feasible, the most effective compensating control is to temporarily disable the plugin and redirect customers to an alternative PayPal payment gateway that correctly implements server-side payment verification - this eliminates the attack surface entirely, at the cost of requiring gateway reconfiguration and potential disruption to active payment flows. Blocking the PayPal return handler URL at a WAF or web server level is not recommended as a sole mitigation because it would break legitimate post-payment redirects for paying customers. Regardless of patch status, store operators should audit all WooCommerce orders completed since the plugin was installed by cross-referencing order records against PayPal transaction logs to identify any orders that may have been fraudulently completed without corresponding payment.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today