YITH PayPal Express Checkout for WooCommerce <= 1.62.1 - Unauthenticated Insufficient Verification of Data Authenticity to Payment Bypass via PayPal IPN
- ID
- WPSEC-2026-1936
- Plugin
- YITH PayPal Express Checkout for WooCommerce (yith-paypal-express-checkout-for-woocommerce)
- Affected
- all versions before 1.63.0
- Remediation
- Update to 1.63.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-345
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-29
- Attack surface
- YITH PayPal Express Checkout for WooCommerce on WPSec AttackSurface
- Fix released
- Published
Description
The YITH PayPal Express Checkout for WooCommerce plugin for WordPress is vulnerable to Payment Bypass via the PayPal IPN handler (WooCommerce API endpoint 'yith_paypal_ec') in all versions up to, and including, 1.62.1, due to insufficient verification of data authenticity. The handler only confirms that PayPal sent the IPN. It does not check that the payment went to the shop's own PayPal merchant account (receiver_email, business or receiver_id). It also accepts an order found by the non-secret invoice number without checking that the IPN refers to the PayPal transaction stored for that order. This makes it possible for unauthenticated attackers to make a PayPal payment to an account they control, give it the reference of an order (for example one they placed themselves), and have PayPal's verified IPN for that payment mark the unpaid order as paid in the store.
References
- https://wpsec.com/vuln/WPSEC-2026-1936/
- https://plugins.svn.wordpress.org/yith-paypal-express-checkout-for-woocommerce/tags/1.63.0/
- https://wordpress.org/plugins/yith-paypal-express-checkout-for-woocommerce/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS