# Subscription & Recurring Payment for WooCommerce <= 2.5.1 - Unauthenticated Payment Bypass via PayPal Return URL

- **ID:** WPSEC-2026-2950
- **Plugin:** Subscriptions for WooCommerce with Stripe Recurring Payments (`subscription`), https://wordpress.org/plugins/subscription/
- **Affected versions:** all versions before 2.5.2
- **Fixed in:** 2.5.2 (Update to 2.5.2 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-345
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-12)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/subscription
- **Fix released:** 2026-11-11
- **Published:** 2026-11-12
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2950/

## Description

The Subscriptions for WooCommerce with Stripe Recurring Payments plugin for WordPress is vulnerable to Payment Bypass via the PayPal order-received return handler in all versions up to, and including, 2.5.1, due to the handler trusting the subscription_id and token query parameters without verifying that the PayPal subscription or order they name belongs to the WooCommerce order being completed. This makes it possible for unauthenticated attackers (where guest checkout is available) to point their own pending order at an unrelated approved or active PayPal subscription or order, such as one from a cheaper purchase, and have the order marked as completed without paying for it.

## References

- https://wpsec.com/vuln/WPSEC-2026-2950/
- https://plugins.svn.wordpress.org/subscription/tags/2.5.2/
- https://wordpress.org/plugins/subscription/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2950/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.