# Payment Gateway for PayPal on WooCommerce <= 9.3.1 - Unauthenticated Payment Bypass via Failed PayPal Order Update

- **ID:** WPSEC-2026-1893
- **Plugin:** Payment Gateway for PayPal on WooCommerce (`woo-paypal-gateway`), https://wordpress.org/plugins/woo-paypal-gateway/
- **Affected versions:** all versions before 9.3.2
- **Fixed in:** 9.3.2 (Update to 9.3.2 or later.)
- **Severity:** Low 3.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-345
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-29)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/woo-paypal-gateway
- **Fix released:** 2026-10-28
- **Published:** 2026-10-29
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1893/

## Description

The Payment Gateway for PayPal on WooCommerce plugin for WordPress is vulnerable to Payment Bypass via the checkout update-then-capture and authorization flows in all versions up to, and including, 9.3.1, due to the plugin ignoring whether the PayPal order update that rebinds the approved PayPal order's amount, invoice ID and custom ID to the WooCommerce order succeeded, and skipping the check of the PayPal order's binding, amount and currency against the target order before capturing or authorizing it. A PayPal capture already recorded on one order could also mark a second order as paid through the payment notification. This makes it possible for unauthenticated attackers, such as guest shoppers who can get PayPal to reject the order update, to have a WooCommerce order marked as paid with a PayPal payment that belongs to another order or does not match the order total, or to have two orders marked as paid for a single payment.

## References

- https://wpsec.com/vuln/WPSEC-2026-1893/
- https://plugins.svn.wordpress.org/woo-paypal-gateway/tags/9.3.2/
- https://wordpress.org/plugins/woo-paypal-gateway/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1893/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.