{
 "id": "WPSEC-2026-1470",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1470/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1470/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1470/index.md",
 "title": "WooCommerce PayPal Payments <= 4.1.3 - Unauthenticated Missing Authorization to Order Processing via Return URL Endpoint",
 "description": "The WooCommerce PayPal Payments plugin for WordPress is vulnerable to Missing Authorization via the PayPal return URL endpoint (wc-ajax=ppc-return-url) in all versions up to, and including, 4.1.3, due to the endpoint loading the PayPal order from the 'token' query parameter and running payment processing for the WooCommerce order named in its custom_id without checking that the request came from the checkout session or customer that created it. This makes it possible for unauthenticated attackers who obtain a PayPal order token to trigger payment processing for another customer's WooCommerce order and to learn whether the WooCommerce order behind a token exists.",
 "plugin": {
  "slug": "woocommerce-paypal-payments",
  "name": "WooCommerce PayPal Payments",
  "full_name": "WooCommerce PayPal Payments",
  "wordpress_org": "https://wordpress.org/plugins/woocommerce-paypal-payments/",
  "advisories_url": "https://wpsec.com/vuln/plugin/woocommerce-paypal-payments/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/woocommerce-paypal-payments"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.8,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "4.2.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 4.2.0"
  ]
 },
 "introduced_in": null,
 "fixed_in": "4.2.0",
 "remediation": "Update to 4.2.0 or later.",
 "fix_released": "2026-10-21T16:14:56+00:00",
 "published": "2026-10-22T16:48:21+00:00",
 "updated": "2026-10-22T10:09:17.573876+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1470/",
  "https://plugins.svn.wordpress.org/woocommerce-paypal-payments/tags/4.2.0/",
  "https://wordpress.org/plugins/woocommerce-paypal-payments/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/woocommerce-paypal-payments",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-10-22"
 }
}