Accept Paypal Stripe With Subscriptions For Woocommerce
Monthly
Payment amount validation bypass in the Accept PayPal & Stripe with Subscriptions for WooCommerce WordPress plugin (all versions through 3.1.0) enables any customer to complete a purchase by paying less than the full order total, with the order subsequently marked as fully paid by the merchant system. The flaw lies in the PayPal Data Transfer (PDT) return handler, which processes the post-payment callback without performing server-side reconciliation of the amount actually transferred against the stored order total. A publicly available exploit is documented by WPScan, though EPSS at 0.14% indicates exploitation has not yet scaled to widespread automated abuse; the real risk is deliberate buyer fraud rather than opportunistic scanning.
Payment verification bypass in the Accept PayPal & Stripe with Subscriptions for WooCommerce plugin (through version 3.1.0) lets unauthenticated shoppers complete WooCommerce orders without paying the merchant a single cent. The plugin fails to validate that the PayPal account receiving the payment matches the merchant's configured account, so an attacker can pay the full order amount to their own PayPal account and the plugin will still mark the order as paid and fulfilled. A publicly available proof-of-concept exists, per WPScan, and EPSS is low (0.14%), indicating no widespread automated exploitation at time of analysis.
Payment amount validation bypass in the Accept PayPal & Stripe with Subscriptions for WooCommerce WordPress plugin (all versions through 3.1.0) enables any customer to complete a purchase by paying less than the full order total, with the order subsequently marked as fully paid by the merchant system. The flaw lies in the PayPal Data Transfer (PDT) return handler, which processes the post-payment callback without performing server-side reconciliation of the amount actually transferred against the stored order total. A publicly available exploit is documented by WPScan, though EPSS at 0.14% indicates exploitation has not yet scaled to widespread automated abuse; the real risk is deliberate buyer fraud rather than opportunistic scanning.
Payment verification bypass in the Accept PayPal & Stripe with Subscriptions for WooCommerce plugin (through version 3.1.0) lets unauthenticated shoppers complete WooCommerce orders without paying the merchant a single cent. The plugin fails to validate that the PayPal account receiving the payment matches the merchant's configured account, so an attacker can pay the full order amount to their own PayPal account and the plugin will still mark the order as paid and fulfilled. A publicly available proof-of-concept exists, per WPScan, and EPSS is low (0.14%), indicating no widespread automated exploitation at time of analysis.