{
 "id": "WPSEC-2026-2952",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2952/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2952/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2952/index.md",
 "title": "Payment Gateway for PayPal Pro, PayPal Checkout & Subscriptions for WooCommerce <= 4.1.0 - Unauthenticated Payment Validation Bypass via PayPal Checkout Order Capture",
 "description": "The Payment Gateway for PayPal Pro, PayPal Checkout & Subscriptions for WooCommerce plugin for WordPress is vulnerable to a payment validation bypass via the PayPal Checkout one-time payment capture AJAX action (pp_capture_order) in all versions up to, and including, 4.1.0. This is due to the plugin not verifying the result of the PayPal capture request. The response body is used whatever the HTTP status, the validation routine always returns true, and the capture status, amount and currency are never compared against the WooCommerce order before it is marked as paid. This makes it possible for unauthenticated attackers (guest customers, where guest checkout is enabled) to have their WooCommerce orders marked as paid when the PayPal capture failed or was never approved, or when the amount captured does not match the order total.",
 "plugin": {
  "slug": "woocommerce-paypal-pro-payment-gateway",
  "name": "Payment Gateway for PayPal Pro, PayPal Checkout & Subscriptions for WooCommerce",
  "full_name": "Payment Gateway for PayPal Pro, PayPal Checkout & Subscriptions for WooCommerce",
  "wordpress_org": "https://wordpress.org/plugins/woocommerce-paypal-pro-payment-gateway/",
  "advisories_url": "https://wpsec.com/vuln/plugin/woocommerce-paypal-pro-payment-gateway/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/woocommerce-paypal-pro-payment-gateway"
 },
 "type": "BYPASS",
 "cwe": [
  "CWE-345"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "4.0.0",
    "from_inclusive": true,
    "to": "4.1.1",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 4.0.0 before 4.1.1"
  ]
 },
 "introduced_in": "4.0.0",
 "fixed_in": "4.1.1",
 "remediation": "Update to 4.1.1 or later.",
 "fix_released": "2026-11-10T09:25:37+00:00",
 "published": "2026-11-12T17:52:14+00:00",
 "updated": "2026-11-12T17:11:31.547838+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2952/",
  "https://plugins.svn.wordpress.org/woocommerce-paypal-pro-payment-gateway/tags/4.1.1/",
  "https://wordpress.org/plugins/woocommerce-paypal-pro-payment-gateway/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/woocommerce-paypal-pro-payment-gateway",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-12"
 }
}