{
 "id": "WPSEC-2026-1936",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1936/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1936/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1936/index.md",
 "title": "YITH PayPal Express Checkout for WooCommerce <= 1.62.1 - Unauthenticated Insufficient Verification of Data Authenticity to Payment Bypass via PayPal IPN",
 "description": "The YITH PayPal Express Checkout for WooCommerce plugin for WordPress is vulnerable to Payment Bypass via the PayPal IPN handler (WooCommerce API endpoint 'yith_paypal_ec') in all versions up to, and including, 1.62.1, due to insufficient verification of data authenticity. The handler only confirms that PayPal sent the IPN. It does not check that the payment went to the shop's own PayPal merchant account (receiver_email, business or receiver_id). It also accepts an order found by the non-secret invoice number without checking that the IPN refers to the PayPal transaction stored for that order. This makes it possible for unauthenticated attackers to make a PayPal payment to an account they control, give it the reference of an order (for example one they placed themselves), and have PayPal's verified IPN for that payment mark the unpaid order as paid in the store.",
 "plugin": {
  "slug": "yith-paypal-express-checkout-for-woocommerce",
  "name": "YITH PayPal Express Checkout for WooCommerce",
  "full_name": "YITH PayPal Express Checkout for WooCommerce",
  "wordpress_org": "https://wordpress.org/plugins/yith-paypal-express-checkout-for-woocommerce/",
  "advisories_url": "https://wpsec.com/vuln/plugin/yith-paypal-express-checkout-for-woocommerce/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/yith-paypal-express-checkout-for-woocommerce"
 },
 "type": "BYPASS",
 "cwe": [
  "CWE-345"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "1.63.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 1.63.0"
  ]
 },
 "introduced_in": null,
 "fixed_in": "1.63.0",
 "remediation": "Update to 1.63.0 or later.",
 "fix_released": "2026-10-28T14:38:13+00:00",
 "published": "2026-10-29T18:50:39+00:00",
 "updated": "2026-10-29T17:44:21.651595+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1936/",
  "https://plugins.svn.wordpress.org/yith-paypal-express-checkout-for-woocommerce/tags/1.63.0/",
  "https://wordpress.org/plugins/yith-paypal-express-checkout-for-woocommerce/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/yith-paypal-express-checkout-for-woocommerce",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-10-29"
 }
}