Payment Gateway for PayPal on WooCommerce <= 9.3.1 - Unauthenticated Payment Bypass via Failed PayPal Order Update
- ID
- WPSEC-2026-1893
- Plugin
- Payment Gateway for PayPal on WooCommerce (woo-paypal-gateway)
- Affected
- all versions before 9.3.2
- Remediation
- Update to 9.3.2 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-345
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-29
- Attack surface
- Payment Gateway for PayPal on WooCommerce on WPSec AttackSurface
- Fix released
- Published
Description
The Payment Gateway for PayPal on WooCommerce plugin for WordPress is vulnerable to Payment Bypass via the checkout update-then-capture and authorization flows in all versions up to, and including, 9.3.1, due to the plugin ignoring whether the PayPal order update that rebinds the approved PayPal order's amount, invoice ID and custom ID to the WooCommerce order succeeded, and skipping the check of the PayPal order's binding, amount and currency against the target order before capturing or authorizing it. A PayPal capture already recorded on one order could also mark a second order as paid through the payment notification. This makes it possible for unauthenticated attackers, such as guest shoppers who can get PayPal to reject the order update, to have a WooCommerce order marked as paid with a PayPal payment that belongs to another order or does not match the order total, or to have two orders marked as paid for a single payment.
References
- https://wpsec.com/vuln/WPSEC-2026-1893/
- https://plugins.svn.wordpress.org/woo-paypal-gateway/tags/9.3.2/
- https://wordpress.org/plugins/woo-paypal-gateway/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS