YITH PayPal Express Checkout for WooCommerce <= 1.62.0 - Unauthenticated Insecure Direct Object Reference via PayPal Express Checkout Return 'order_id' and 'order_key' Parameters
- ID
- WPSEC-2026-1314
- Plugin
- YITH PayPal Express Checkout for WooCommerce (yith-paypal-express-checkout-for-woocommerce)
- Affected
- all versions before 1.62.1
- Remediation
- Update to 1.62.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-639
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-21
- Attack surface
- YITH PayPal Express Checkout for WooCommerce on WPSec AttackSurface
- Fix released
- Published
Description
The YITH PayPal Express Checkout for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference via the PayPal Express Checkout return handler (WooCommerce API endpoint 'yith_paypal_ec'), in both the main gateway and the BH Subscriptions integration, in all versions up to, and including, 1.62.0. This is due to the handler loading the order named by the user-controlled 'order_id' parameter, or the order found from 'order_key', without validating the order key or checking that the PayPal token and checkout data belong to that order. This makes it possible for unauthenticated attackers who hold a valid PayPal checkout token to run the checkout return flow against orders they do not own. They can write their PayPal payer details into those orders' meta, mark the orders as failed when the payment call returns an error, or run the payment flow on them.
References
- https://wpsec.com/vuln/WPSEC-2026-1314/
- https://plugins.svn.wordpress.org/yith-paypal-express-checkout-for-woocommerce/tags/1.62.1/
- https://wordpress.org/plugins/yith-paypal-express-checkout-for-woocommerce/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS