What is the CVSS score of CVE-2026-59547?

CVE-2026-59547 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of Payment Gateway for PayPal are affected by CVE-2026-59547?

The Payment Gateway for PayPal plugin on WooCommerce (versions ≤9.1.4) allows unauthenticated remote attackers to tamper with payment transaction data due to missing access controls, directly…

How to fix or mitigate CVE-2026-59547?

Within 24 hours: Identify all WordPress instances running Payment Gateway for PayPal plugin and determine installed versions. Within 7 days: For version 9.1.4 or earlier, implement web application firewall rules blocking unauthenticated access to payment processing endpoints, enable transaction logging and alerts for unauthorized modification attempts, and restrict administrative access to payment settings. Within 30 days: Monitor Patchstack security advisories and PayPal vendor guidance for patched version 9.1.5 or later; deploy patch immediately upon release or migrate to an alternative payment processor if no fix is made available.

Payment Gateway for PayPal CVE-2026-59547

EUVD-2026-48199 HIGH

Missing Authorization (CWE-862)

2026-07-23 Patchstack

GHSA-hfpc-3385-8g9j

WordPress Authentication Bypass Wordpress Plugin Payment Gateway For Paypal On Woocommerce

7.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

vuln.today AI

7.5 HIGH

Unauthenticated network-reachable missing-authorization flaw (PR:N, AC:L, UI:N) permitting unauthorized data modification, so integrity-only impact (I:H) with no confidentiality or availability effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 12:43 vuln.today

CVE Published

Jul 23, 2026 - 11:18 cve.org

HIGH 7.5

DescriptionCVE.org

Unauthenticated Broken Access Control in Payment Gateway for PayPal on WooCommerce <= 9.1.4 versions.

AnalysisAI

Broken access control in the Payment Gateway for PayPal on WooCommerce WordPress plugin (versions <= 9.1.4) lets remote unauthenticated attackers tamper with integrity-sensitive data due to a missing authorization check. Reported by Patchstack and tagged as an authentication bypass, the flaw exposes protected plugin functionality without any login. No public exploit code and no CISA KEV listing were identified at time of analysis.

Technical ContextAI

The affected component is a WordPress/WooCommerce plugin (CPE cpe:2.3:a:easy_payment:payment_gateway_for_paypal_on_woocommerce, slug woo-paypal-gateway) that integrates PayPal payment processing into WooCommerce stores. The root cause is CWE-862 (Missing Authorization): one or more plugin actions - typically exposed through WordPress AJAX handlers or REST/admin-post endpoints - fail to verify the caller's capabilities or a valid nonce before executing privileged logic. Because WordPress plugins commonly register such handlers on hooks reachable by any visitor (e.g. wp_ajax_nopriv_ or unauthenticated REST routes), the missing check allows callers who should have no access to invoke functionality that alters plugin state.

RemediationAI

Update the plugin to the first release above 9.1.4 as published by the vendor; the input data does not name an exact fixed version, so treat this as 'patch available per vendor advisory' and confirm the fixed release on the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/woo-paypal-gateway/vulnerability/wordpress-payment-gateway-for-paypal-on-woocommerce-plugin-9-1-4-broken-access-control-vulnerability) or the plugin's WordPress.org changelog before deploying. If an updated version is not yet available in your environment, compensating controls include placing a WAF or virtual patch (Patchstack's own mitigation, or rules restricting the plugin's AJAX/admin-post/REST endpoints to authenticated privileged users) in front of the site, or temporarily deactivating the plugin and switching to an alternative PayPal integration - noting that deactivation disables PayPal checkout and will interrupt store payment flow. Do not invent a version number; verify the exact patched release with the vendor.