What is the CVSS score of CVE-2026-17008?

CVE-2026-17008 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.1%.

Is there a public PoC exploit available for CVE-2026-17008?

Yes, a public proof-of-concept exploit is available for CVE-2026-17008. Prioritise patching immediately. EPSS: 0.1%.

Quick Paypal Payments CVE-2026-17008

EUVD-2026-57176 MEDIUM

2026-08-12 WPScan

GHSA-wpmj-p56j-6mq2

WordPress Information Disclosure Quick Paypal Payments Unknown

5.3

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

5.3 MEDIUM

Network-accessible IPN endpoint requires no authentication beyond buyer checkout initiation; integrity impact is scoped to fraudulent order status; no confidentiality or availability impact is introduced.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 12, 2026 - 12:21 vuln.today

CVE Published

Aug 12, 2026 - 11:24 cve.org

MEDIUM 5.3

DescriptionCVE.org

The Quick Paypal Payments WordPress plugin through 5.7.50 does not verify the paid amount, receiver, or payment status in its PayPal IPN handler and marks an order paid on an order-token match alone, so a buyer who pays an arbitrary small amount can have a full-price order marked paid.

AnalysisAI

Fraudulent order completion in the Quick Paypal Payments WordPress plugin (all versions through 5.7.50) enables any buyer to acquire full-price goods or services by paying an arbitrary small amount. The plugin's PayPal IPN handler validates only the order token when determining whether to mark an order as paid - ignoring the payment amount, receiver address, and payment status entirely - so any buyer who can initiate a checkout can trivially complete a full-value order for pennies. Publicly available exploit code exists, reported by WPScan, making immediate opportunistic exploitation straightforward for any motivated attacker targeting affected WordPress storefronts.

Technical ContextAI

PayPal's Instant Payment Notification (IPN) system delivers asynchronous HTTP callbacks to a merchant-configured endpoint when payment events occur. A correctly implemented IPN handler must validate at minimum: that the payment_status field equals 'Completed', that the mc_gross amount matches the expected order total, and that the receiver_email corresponds to the merchant's PayPal account - and optionally verify the payload authenticity with PayPal's IPN verification API. The Quick Paypal Payments plugin (CPE: cpe:2.3:a:unknown:quick_paypal_payments:*:*:*:*:*:*:*:*) skips all of these checks and relies solely on an order-token match to approve an order, constituting a business logic failure. No CWE is formally assigned, but the flaw most closely maps to CWE-345 (Insufficient Verification of Data Authenticity) and CWE-602 (Client-Side Enforcement of Server-Side Security). The CPE vendor field is listed as 'unknown' in NVD, indicating the publisher identity was not resolved at ingestion time, though the plugin identity is otherwise unambiguous.

RemediationAI

No vendor-released patch has been identified at time of analysis for any version of Quick Paypal Payments. Site administrators should immediately deactivate and remove the plugin from all WordPress installations to eliminate the attack surface; leaving it active while awaiting a patch is not advisable given the publicly available exploit. As an urgent compensating measure, merchants should cross-reference all recent orders processed through this plugin against their PayPal transaction history to identify discrepancies between order totals and actual payment amounts received - any mismatch indicates potential fraud. Enabling PayPal's transaction dispute alerts and seller notification emails can surface future fraud attempts during any interim period. Replacing the plugin with a well-maintained, actively audited PayPal integration - such as the official WooCommerce PayPal Payments plugin - is strongly recommended as a permanent solution. Refer to the WPScan advisory at https://wpscan.com/vulnerability/605c0c65-6258-411a-a028-f3de25613bdf/ for ongoing patch status updates.