Quick Paypal Payments
Monthly
Fraudulent order completion in the Quick Paypal Payments WordPress plugin (all versions through 5.7.50) enables any buyer to acquire full-price goods or services by paying an arbitrary small amount. The plugin's PayPal IPN handler validates only the order token when determining whether to mark an order as paid - ignoring the payment amount, receiver address, and payment status entirely - so any buyer who can initiate a checkout can trivially complete a full-value order for pennies. Publicly available exploit code exists, reported by WPScan, making immediate opportunistic exploitation straightforward for any motivated attacker targeting affected WordPress storefronts.
The Quick Paypal Payments WordPress plugin before 5.7.26.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Auth. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Unauth. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Auth. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Fraudulent order completion in the Quick Paypal Payments WordPress plugin (all versions through 5.7.50) enables any buyer to acquire full-price goods or services by paying an arbitrary small amount. The plugin's PayPal IPN handler validates only the order token when determining whether to mark an order as paid - ignoring the payment amount, receiver address, and payment status entirely - so any buyer who can initiate a checkout can trivially complete a full-value order for pennies. Publicly available exploit code exists, reported by WPScan, making immediate opportunistic exploitation straightforward for any motivated attacker targeting affected WordPress storefronts.
The Quick Paypal Payments WordPress plugin before 5.7.26.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Auth. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Unauth. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Auth. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.