Quick Paypal Payments CVE-2026-17008

The target site must be running the Quick Paypal Payments WordPress plugin at version 5.7.50 or earlier with an active PayPal IPN endpoint configured and receiving callbacks. An attacker must be able to initiate a standard checkout to obtain a valid order token - this requires no special privileges beyond being a store customer. Exploitation further requires the attacker to trigger a PayPal IPN callback to the vulnerable endpoint, either by completing a real low-value PayPal payment or by crafting a forged IPN request if the plugin does not independently verify payload authenticity with PayPal's verification API. Exploitation is bounded to WordPress sites actively using this specific plugin for payment processing; sites using any other payment gateway are unaffected. The CVSS vector PR:N is consistent with the buyer-level access required, as no administrative or authenticated session is needed beyond normal checkout initiation.

The NVD CVSS score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) substantially understates the real-world business impact: this is a direct financial fraud enabler, not merely an abstract integrity flaw. The zero-complexity exploitation path - initiate checkout, pay a trivial amount, receive goods - combined with publicly available exploit code from WPScan means the effective attacker skill threshold is negligible. No EPSS score was provided in available data, and the vulnerability is not currently listed in CISA KEV, suggesting widespread automated exploitation has not yet been confirmed; however, the simplicity and financial upside of this attack make sustained attacker interest likely. Even a mid-sized municipal IT team in boleslawiec operating a WordPress-based e-commerce storefront should treat this as urgent given that any customer-facing checkout flow is a direct attack surface. The SSVC signals reinforce urgency: the attack is automatable (no manual interaction required beyond initiating a checkout), the technical impact is direct financial loss to merchants, and no patch is currently available. The 'Information Disclosure' tag present in the intelligence metadata appears mislabeled and should not inform risk prioritization - the actual harm is business logic bypass enabling payment fraud.

A buyer initiates a legitimate checkout on a WordPress site running Quick Paypal Payments, obtains a valid order token through the standard purchase flow, and submits a PayPal payment of a negligible amount such as $0.01 against a full-price order. The plugin's IPN handler receives the PayPal callback, matches the order token, and immediately marks the order as fully paid without inspecting the amount, receiver, or status fields. A publicly available exploit from WPScan documents this technique, meaning systematic and automated fraud across multiple storefronts is realistic for a motivated attacker.