EUVD-2026-57175
GHSA-4h7v-8qrm-x2jj
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Fully network-accessible with no prerequisites; only payment amount integrity is affected, with no confidentiality or availability impact on the underlying system.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
2DescriptionCVE.org
The Payment Button for PayPal WordPress plugin through 1.2.3.44 does not enforce the merchant-configured price server-side and trusts a client-supplied payment amount, allowing unauthenticated attackers to create a real PayPal order against the merchant for an arbitrary lower amount.
AnalysisAI
Price manipulation in the Payment Button for PayPal WordPress plugin (all versions through 1.2.3.44) enables unauthenticated remote visitors to complete real PayPal transactions at self-specified amounts, causing direct financial loss to the merchant. The plugin forwards whatever payment amount the browser submits to PayPal without any server-side comparison against the merchant-configured price, meaning a buyer can purchase any listed product or service for an arbitrarily low value - including fractions of a cent. A publicly available proof-of-concept exploit exists per WPScan intelligence, lowering the bar for opportunistic financial fraud against any affected storefront.
Technical ContextAI
The Payment Button for PayPal WordPress plugin (CPE: cpe:2.3:a:unknown:payment_button_for_paypal:*:*:*:*:*:*:*:*) embeds a PayPal Checkout button directly into WordPress pages, rendering the item price client-side and relying on the browser to pass that amount into the PayPal order creation flow. The root cause is a business logic error - a missing server-side enforcement step that would verify the submitted amount against the stored product price before transacting. No formal CWE is assigned, but this maps most closely to CWE-602 (Client-Side Enforcement of Server-Side Security) or CWE-20 (Improper Input Validation). The CVSS vector AV:N/AC:L/PR:N/UI:N confirms the flaw is fully network-exploitable without authentication, elevated privileges, or user interaction on the victim side. The integrity impact (I:L) captures manipulation of the payment record while leaving the underlying WordPress system and database untouched.
RemediationAI
No vendor-released patch identified at time of analysis - all known versions through 1.2.3.44 are affected and no fixed version is confirmed in any available source. The most effective immediate control is to deactivate and remove the Payment Button for PayPal plugin from all affected WordPress installations until an updated release is published. As a compensating control for merchants who cannot immediately remove the plugin, implement server-side order verification using PayPal's Webhooks (PAYMENT.CAPTURE.COMPLETED event) or IPN to compare the captured amount against the expected order total stored in the WordPress database before fulfilling any order - mismatches should trigger automatic order cancellation and a manual fraud review queue; note that this requires custom development effort and does not fix the underlying flaw. Do not rely on client-side JavaScript price validation as a mitigation, as it is trivially bypassed by the same method used in the initial exploit. Monitor https://wpscan.com/vulnerability/97c08603-c407-43b2-ab2c-e39f85e89ebe/ and the WordPress plugin repository changelog for a patched release.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today