WooCommerce PayPal Payments <= 4.1.3 - Unauthenticated Missing Authorization to Order Processing via Return URL Endpoint
- ID
- WPSEC-2026-1470
- Plugin
- WooCommerce PayPal Payments (woocommerce-paypal-payments)
- Affected
- all versions before 4.2.0
- Remediation
- Update to 4.2.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-22
- Attack surface
- WooCommerce PayPal Payments on WPSec AttackSurface
- Fix released
- Published
Description
The WooCommerce PayPal Payments plugin for WordPress is vulnerable to Missing Authorization via the PayPal return URL endpoint (wc-ajax=ppc-return-url) in all versions up to, and including, 4.1.3, due to the endpoint loading the PayPal order from the 'token' query parameter and running payment processing for the WooCommerce order named in its custom_id without checking that the request came from the checkout session or customer that created it. This makes it possible for unauthenticated attackers who obtain a PayPal order token to trigger payment processing for another customer's WooCommerce order and to learn whether the WooCommerce order behind a token exists.
References
- https://wpsec.com/vuln/WPSEC-2026-1470/
- https://plugins.svn.wordpress.org/woocommerce-paypal-payments/tags/4.2.0/
- https://wordpress.org/plugins/woocommerce-paypal-payments/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS