# WooCommerce PayPal Payments <= 4.1.3 - Unauthenticated Missing Authorization to Order Processing via Return URL Endpoint

- **ID:** WPSEC-2026-1470
- **Plugin:** WooCommerce PayPal Payments (`woocommerce-paypal-payments`), https://wordpress.org/plugins/woocommerce-paypal-payments/
- **Affected versions:** all versions before 4.2.0
- **Fixed in:** 4.2.0 (Update to 4.2.0 or later.)
- **Severity:** Medium 4.8 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-22)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/woocommerce-paypal-payments
- **Fix released:** 2026-10-21
- **Published:** 2026-10-22
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1470/

## Description

The WooCommerce PayPal Payments plugin for WordPress is vulnerable to Missing Authorization via the PayPal return URL endpoint (wc-ajax=ppc-return-url) in all versions up to, and including, 4.1.3, due to the endpoint loading the PayPal order from the 'token' query parameter and running payment processing for the WooCommerce order named in its custom_id without checking that the request came from the checkout session or customer that created it. This makes it possible for unauthenticated attackers who obtain a PayPal order token to trigger payment processing for another customer's WooCommerce order and to learn whether the WooCommerce order behind a token exists.

## References

- https://wpsec.com/vuln/WPSEC-2026-1470/
- https://plugins.svn.wordpress.org/woocommerce-paypal-payments/tags/4.2.0/
- https://wordpress.org/plugins/woocommerce-paypal-payments/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1470/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.