EUVD-2026-55027
GHSA-3gq9-83xc-rrc7
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
AC:H captures the non-default PDT configuration prerequisite; PR:N as the attacker operates as any ordinary buyer; I:L for order integrity fraud with no confidentiality or availability impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The Accept PayPal & Stripe with Subscriptions for WooCommerce WordPress plugin through 3.1.0 does not validate the amount actually paid against the order total in its PayPal Data Transfer return handler, allowing a customer to pay less than the order total and still have the order marked as fully paid when the PayPal Data Transfer feature is enabled.
AnalysisAI
Payment amount validation bypass in the Accept PayPal & Stripe with Subscriptions for WooCommerce WordPress plugin (all versions through 3.1.0) enables any customer to complete a purchase by paying less than the full order total, with the order subsequently marked as fully paid by the merchant system. The flaw lies in the PayPal Data Transfer (PDT) return handler, which processes the post-payment callback without performing server-side reconciliation of the amount actually transferred against the stored order total. A publicly available exploit is documented by WPScan, though EPSS at 0.14% indicates exploitation has not yet scaled to widespread automated abuse; the real risk is deliberate buyer fraud rather than opportunistic scanning.
Technical ContextAI
The affected component is the PayPal Data Transfer (PDT) return handler within the Accept PayPal & Stripe with Subscriptions for WooCommerce WordPress plugin (CPE: cpe:2.3:a:unknown:accept_paypal_&_stripe_with_subscriptions_for_woocommerce:*:*:*:*:*:*:*:*, versions through 3.1.0). PayPal Data Transfer is a legacy integration mechanism in which PayPal redirects the buyer back to the merchant's return URL after checkout and passes transaction details - including amount - via URL parameters or a PDT token. Correct implementation requires the merchant to query PayPal's PDT API server-to-server to retrieve authoritative transaction data; this plugin instead trusts the client-facing return data without that server-side verification step. CWE-284 (Improper Access Control) accurately captures the root cause: the handler does not enforce the access control invariant that only fully-paid amounts should transition an order to 'paid' status, allowing a buyer to manipulate the effective payment amount through the client-controlled return flow.
RemediationAI
No vendor-released patched version is confirmed in available data at time of analysis - the affected version ceiling of 3.1.0 indicates no fix has been published to the WPScan or NVD records. The primary immediate compensating control is to disable the PayPal Data Transfer (PDT) feature within the plugin settings and switch to PayPal Instant Payment Notification (IPN), which uses asynchronous server-to-server callbacks that cannot be manipulated by the buyer's browser session; this eliminates the vulnerable code path without removing PayPal payment functionality entirely, though IPN requires server-accessible webhook endpoints. If IPN is not feasible, disabling the plugin entirely and substituting a WooCommerce-compatible payment gateway that performs server-side amount verification (such as the official WooCommerce PayPal Payments plugin) is the safest alternative. Store operators should audit historical orders processed via the PDT flow for amount discrepancies - compare captured PayPal transaction amounts against WooCommerce order totals - to assess potential prior fraud. Monitor https://wpscan.com/vulnerability/fb73461f-521a-401b-98d0-5f32272368b8/ for patch availability.
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today