EUVD-2026-55028
GHSA-645w-cxcg-9mjc
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Network-reachable unauthenticated checkout flow; no confidentiality or availability impact; integrity limited to fraudulent order status change within the vulnerable application.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The Accept PayPal & Stripe with Subscriptions for WooCommerce WordPress plugin through 3.1.0 does not verify that the PayPal account which received a payment matches the merchant's configured account before marking the order as paid, allowing unauthenticated buyers to complete a WooCommerce order by paying the full amount to their own PayPal account instead of the merchant's.
AnalysisAI
Payment verification bypass in the Accept PayPal & Stripe with Subscriptions for WooCommerce plugin (through version 3.1.0) lets unauthenticated shoppers complete WooCommerce orders without paying the merchant a single cent. The plugin fails to validate that the PayPal account receiving the payment matches the merchant's configured account, so an attacker can pay the full order amount to their own PayPal account and the plugin will still mark the order as paid and fulfilled. A publicly available proof-of-concept exists, per WPScan, and EPSS is low (0.14%), indicating no widespread automated exploitation at time of analysis.
Technical ContextAI
This is a WordPress WooCommerce payment plugin (CPE: cpe:2.3:a:unknown:accept_paypal_&_stripe_with_subscriptions_for_woocommerce) that processes PayPal and Stripe payments for subscription-capable WooCommerce storefronts. The root cause is CWE-284 (Improper Access Control): when a PayPal Instant Payment Notification (IPN) or equivalent callback is received, the plugin records the order as paid based on the presence of a valid transaction confirmation without cross-checking the destination PayPal account against the site's configured merchant credentials. This is a classic payment verification logic flaw, similar to historical vulnerabilities in other WooCommerce PayPal extensions, where the payment amount and currency are checked but the recipient account identity is not.
RemediationAI
No specific patched version number has been confirmed in the available data sources at time of analysis. Merchants should immediately check the WordPress plugin repository and the vendor's release notes for any version above 3.1.0 that addresses this verification flaw; if a patched release exists, upgrading to it is the primary remediation. If no patched version is available, the plugin should be deactivated immediately via the WordPress admin panel (Plugins > Deactivate) to eliminate the attack surface - this will disable PayPal payment processing but prevent fraudulent order completion. As a compensating control, merchants can switch to an alternative, well-maintained WooCommerce PayPal gateway plugin that implements proper IPN recipient account verification. Merchants should also audit all recent orders processed through the plugin for signs of prior exploitation: look for orders marked paid where the associated PayPal transaction ID does not correspond to a credit in the merchant's PayPal account. The WPScan advisory at https://wpscan.com/vulnerability/01cc2578-8bf8-4889-9e21-7b78cae074d7/ should be monitored for patch status updates.
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today