Braintree for WooCommerce Payment Gateway <= 3.12.0 - Unauthenticated Payment Verification Bypass via Unvalidated Payment Method Nonce Type
- ID
- WPSEC-2026-0704
- Plugin
- PayPal Enterprise Payments (formerly Braintree) for WooCommerce (woocommerce-gateway-paypal-powered-by-braintree)
- Affected
- all versions before 3.12.1
- Remediation
- Update to 3.12.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-345
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-10
- Attack surface
- Braintree for WooCommerce Payment Gateway on WPSec AttackSurface
- Fix released
- Published
Description
The PayPal Enterprise Payments (formerly Braintree) for WooCommerce plugin for WordPress is vulnerable to payment verification bypass via the PayPal, Venmo, local payment, Apple Pay and Google Pay checkout flows in all versions up to, and including, 3.12.0. This is due to the plugin not checking with Braintree that the payment method behind a submitted payment method nonce is the type the selected gateway expects. This makes it possible for unauthenticated attackers to pay with a regular card nonce through these flows, skipping the 3D Secure and card security code checks the store owner enabled for card payments.
References
- https://wpsec.com/vuln/WPSEC-2026-0704/
- https://plugins.svn.wordpress.org/woocommerce-gateway-paypal-powered-by-braintree/tags/3.12.1/
- https://wordpress.org/plugins/woocommerce-gateway-paypal-powered-by-braintree/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS