Payment Button For Paypal
Monthly
Price manipulation in the Payment Button for PayPal WordPress plugin (all versions through 1.2.3.44) enables unauthenticated remote visitors to complete real PayPal transactions at self-specified amounts, causing direct financial loss to the merchant. The plugin forwards whatever payment amount the browser submits to PayPal without any server-side comparison against the merchant-configured price, meaning a buyer can purchase any listed product or service for an arbitrarily low value - including fractions of a cent. A publicly available proof-of-concept exploit exists per WPScan intelligence, lowering the bar for opportunistic financial fraud against any affected storefront.
Price manipulation in the Payment Button for PayPal WordPress plugin (all versions through 1.2.3.44) enables unauthenticated remote visitors to complete real PayPal transactions at self-specified amounts, causing direct financial loss to the merchant. The plugin forwards whatever payment amount the browser submits to PayPal without any server-side comparison against the merchant-configured price, meaning a buyer can purchase any listed product or service for an arbitrarily low value - including fractions of a cent. A publicly available proof-of-concept exploit exists per WPScan intelligence, lowering the bar for opportunistic financial fraud against any affected storefront.