Payment Gateway For Paypal On Woocommerce
Monthly
Broken access control in the Payment Gateway for PayPal on WooCommerce WordPress plugin (versions <= 9.1.4) lets remote unauthenticated attackers tamper with integrity-sensitive data due to a missing authorization check. Reported by Patchstack and tagged as an authentication bypass, the flaw exposes protected plugin functionality without any login. No public exploit code and no CISA KEV listing were identified at time of analysis.
Payment fraud in the Payment Gateway for PayPal on WooCommerce WordPress plugin (all versions before 9.2.1) enables unauthenticated remote attackers to mark arbitrary WooCommerce orders as paid without completing actual payment. The plugin's PayPal return handler reads attacker-controlled URL parameters and completes orders regardless of whether server-side gateway verification passes or fails, with no amount comparison and no order-ownership validation. A publicly available proof-of-concept exploit exists per WPScan; while the official CVSS score is 5.3, the financial fraud impact on affected e-commerce stores is materially higher in practice.
Broken access control in the Payment Gateway for PayPal on WooCommerce WordPress plugin (versions <= 9.1.4) lets remote unauthenticated attackers tamper with integrity-sensitive data due to a missing authorization check. Reported by Patchstack and tagged as an authentication bypass, the flaw exposes protected plugin functionality without any login. No public exploit code and no CISA KEV listing were identified at time of analysis.
Payment fraud in the Payment Gateway for PayPal on WooCommerce WordPress plugin (all versions before 9.2.1) enables unauthenticated remote attackers to mark arbitrary WooCommerce orders as paid without completing actual payment. The plugin's PayPal return handler reads attacker-controlled URL parameters and completes orders regardless of whether server-side gateway verification passes or fails, with no amount comparison and no order-ownership validation. A publicly available proof-of-concept exploit exists per WPScan; while the official CVSS score is 5.3, the financial fraud impact on affected e-commerce stores is materially higher in practice.