{
 "id": "WPSEC-2026-1314",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1314/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1314/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1314/index.md",
 "title": "YITH PayPal Express Checkout for WooCommerce <= 1.62.0 - Unauthenticated Insecure Direct Object Reference via PayPal Express Checkout Return 'order_id' and 'order_key' Parameters",
 "description": "The YITH PayPal Express Checkout for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference via the PayPal Express Checkout return handler (WooCommerce API endpoint 'yith_paypal_ec'), in both the main gateway and the BH Subscriptions integration, in all versions up to, and including, 1.62.0. This is due to the handler loading the order named by the user-controlled 'order_id' parameter, or the order found from 'order_key', without validating the order key or checking that the PayPal token and checkout data belong to that order. This makes it possible for unauthenticated attackers who hold a valid PayPal checkout token to run the checkout return flow against orders they do not own. They can write their PayPal payer details into those orders' meta, mark the orders as failed when the payment call returns an error, or run the payment flow on them.",
 "plugin": {
  "slug": "yith-paypal-express-checkout-for-woocommerce",
  "name": "YITH PayPal Express Checkout for WooCommerce",
  "full_name": "YITH PayPal Express Checkout for WooCommerce",
  "wordpress_org": "https://wordpress.org/plugins/yith-paypal-express-checkout-for-woocommerce/",
  "advisories_url": "https://wpsec.com/vuln/plugin/yith-paypal-express-checkout-for-woocommerce/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/yith-paypal-express-checkout-for-woocommerce"
 },
 "type": "IDOR",
 "cwe": [
  "CWE-639"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "1.62.1",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 1.62.1"
  ]
 },
 "introduced_in": null,
 "fixed_in": "1.62.1",
 "remediation": "Update to 1.62.1 or later.",
 "fix_released": "2026-10-19T11:28:15+00:00",
 "published": "2026-10-21T10:43:36+00:00",
 "updated": "2026-10-21T10:35:57.081410+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1314/",
  "https://plugins.svn.wordpress.org/yith-paypal-express-checkout-for-woocommerce/tags/1.62.1/",
  "https://wordpress.org/plugins/yith-paypal-express-checkout-for-woocommerce/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/yith-paypal-express-checkout-for-woocommerce",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-10-21"
 }
}