Payment Gateway for PayPal Pro, PayPal Checkout & Subscriptions for WooCommerce <= 4.1.0 - Unauthenticated Payment Validation Bypass via PayPal Checkout Order Capture
- ID
- WPSEC-2026-2952
- Plugin
- Payment Gateway for PayPal Pro, PayPal Checkout & Subscriptions for WooCommerce (woocommerce-paypal-pro-payment-gateway)
- Affected
- from 4.0.0 before 4.1.1
- Remediation
- Update to 4.1.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-345
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-12
- Attack surface
- Payment Gateway for PayPal Pro, PayPal Checkout & Subscriptions for WooCommerce on WPSec AttackSurface
- Fix released
- Published
Description
The Payment Gateway for PayPal Pro, PayPal Checkout & Subscriptions for WooCommerce plugin for WordPress is vulnerable to a payment validation bypass via the PayPal Checkout one-time payment capture AJAX action (pp_capture_order) in all versions up to, and including, 4.1.0. This is due to the plugin not verifying the result of the PayPal capture request. The response body is used whatever the HTTP status, the validation routine always returns true, and the capture status, amount and currency are never compared against the WooCommerce order before it is marked as paid. This makes it possible for unauthenticated attackers (guest customers, where guest checkout is enabled) to have their WooCommerce orders marked as paid when the PayPal capture failed or was never approved, or when the amount captured does not match the order total.
References
- https://wpsec.com/vuln/WPSEC-2026-2952/
- https://plugins.svn.wordpress.org/woocommerce-paypal-pro-payment-gateway/tags/4.1.1/
- https://wordpress.org/plugins/woocommerce-paypal-pro-payment-gateway/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS