# YITH PayPal Express Checkout for WooCommerce <= 1.62.0 - Unauthenticated Insecure Direct Object Reference via PayPal Express Checkout Return 'order_id' and 'order_key' Parameters

- **ID:** WPSEC-2026-1314
- **Plugin:** YITH PayPal Express Checkout for WooCommerce (`yith-paypal-express-checkout-for-woocommerce`), https://wordpress.org/plugins/yith-paypal-express-checkout-for-woocommerce/
- **Affected versions:** all versions before 1.62.1
- **Fixed in:** 1.62.1 (Update to 1.62.1 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-639
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-21)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/yith-paypal-express-checkout-for-woocommerce
- **Fix released:** 2026-10-19
- **Published:** 2026-10-21
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1314/

## Description

The YITH PayPal Express Checkout for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference via the PayPal Express Checkout return handler (WooCommerce API endpoint 'yith_paypal_ec'), in both the main gateway and the BH Subscriptions integration, in all versions up to, and including, 1.62.0. This is due to the handler loading the order named by the user-controlled 'order_id' parameter, or the order found from 'order_key', without validating the order key or checking that the PayPal token and checkout data belong to that order. This makes it possible for unauthenticated attackers who hold a valid PayPal checkout token to run the checkout return flow against orders they do not own. They can write their PayPal payer details into those orders' meta, mark the orders as failed when the payment call returns an error, or run the payment flow on them.

## References

- https://wpsec.com/vuln/WPSEC-2026-1314/
- https://plugins.svn.wordpress.org/yith-paypal-express-checkout-for-woocommerce/tags/1.62.1/
- https://wordpress.org/plugins/yith-paypal-express-checkout-for-woocommerce/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1314/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.