Subscription & Recurring Payment for WooCommerce <= 2.5.1 - Unauthenticated Payment Bypass via PayPal Return URL
- ID
- WPSEC-2026-2950
- Plugin
- Subscriptions for WooCommerce with Stripe Recurring Payments (subscription)
- Affected
- all versions before 2.5.2
- Remediation
- Update to 2.5.2 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-345
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-12
- Attack surface
- Subscription & Recurring Payment for WooCommerce on WPSec AttackSurface
- Fix released
- Published
Description
The Subscriptions for WooCommerce with Stripe Recurring Payments plugin for WordPress is vulnerable to Payment Bypass via the PayPal order-received return handler in all versions up to, and including, 2.5.1, due to the handler trusting the subscription_id and token query parameters without verifying that the PayPal subscription or order they name belongs to the WooCommerce order being completed. This makes it possible for unauthenticated attackers (where guest checkout is available) to point their own pending order at an unrelated approved or active PayPal subscription or order, such as one from a cheaper purchase, and have the order marked as completed without paying for it.
References
- https://wpsec.com/vuln/WPSEC-2026-2950/
- https://plugins.svn.wordpress.org/subscription/tags/2.5.2/
- https://wordpress.org/plugins/subscription/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS