# YITH PayPal Express Checkout for WooCommerce <= 1.62.1 - Unauthenticated Insufficient Verification of Data Authenticity to Payment Bypass via PayPal IPN

- **ID:** WPSEC-2026-1936
- **Plugin:** YITH PayPal Express Checkout for WooCommerce (`yith-paypal-express-checkout-for-woocommerce`), https://wordpress.org/plugins/yith-paypal-express-checkout-for-woocommerce/
- **Affected versions:** all versions before 1.63.0
- **Fixed in:** 1.63.0 (Update to 1.63.0 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-345
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-29)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/yith-paypal-express-checkout-for-woocommerce
- **Fix released:** 2026-10-28
- **Published:** 2026-10-29
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1936/

## Description

The YITH PayPal Express Checkout for WooCommerce plugin for WordPress is vulnerable to Payment Bypass via the PayPal IPN handler (WooCommerce API endpoint 'yith_paypal_ec') in all versions up to, and including, 1.62.1, due to insufficient verification of data authenticity. The handler only confirms that PayPal sent the IPN. It does not check that the payment went to the shop's own PayPal merchant account (receiver_email, business or receiver_id). It also accepts an order found by the non-secret invoice number without checking that the IPN refers to the PayPal transaction stored for that order. This makes it possible for unauthenticated attackers to make a PayPal payment to an account they control, give it the reference of an order (for example one they placed themselves), and have PayPal's verified IPN for that payment mark the unpaid order as paid in the store.

## References

- https://wpsec.com/vuln/WPSEC-2026-1936/
- https://plugins.svn.wordpress.org/yith-paypal-express-checkout-for-woocommerce/tags/1.63.0/
- https://wordpress.org/plugins/yith-paypal-express-checkout-for-woocommerce/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1936/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.