CVE-2025-63023
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
The Payment Gateway for PayPal on WooCommerce plugin contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. The issue affects versions up to and including 9.0.53.
Risk Assessment
An attacker may gain access to payment gateway settings without permissions, potentially leading to transaction manipulation or theft of payment data.
Recommendation
Update the Payment Gateway for PayPal on WooCommerce plugin to the latest version that includes the security fix.
Other vulnerabilities in Payment Gateway for PayPal on WooCommerce
See all- CVE-2026-59547High
The Payment Gateway for PayPal on WooCommerce plugin up to version 9.1.4 contains an unauthenticated Broken Access Control vulnerability. An unauthenticated attacker can bypass authorization mechanisms and gain unauthorized access to functions or data.
- CVE-2026-92400Medium
The Payment Gateway for PayPal on WooCommerce WordPress plugin before 9.2.1 does not verify that an incoming payment notification was confirmed in the store's configured payment environment or paid to the store's own merchant account before marking an order complete. This allows unauthenticated users to mark their own orders as paid using a genuine transaction from a payment sandbox they control.
- CVE-2026-16621Medium
The Payment Gateway for PayPal on WooCommerce WordPress plugin before 9.2.1 does not verify that payment actually succeeded before completing an order in its PayPal return handler: it reads attacker-controlled parameters, performs no amount comparison and no order-ownership check, and completes the order even when the server-side gateway verification fails, allowing an unauthenticated attacker to mark arbitrary orders as paid without paying.
Original NVD description (English source)
Missing Authorization vulnerability in Easy Payment Payment Gateway for PayPal on WooCommerce woo-paypal-gateway allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Payment Gateway for PayPal on WooCommerce: from n/a through <= 9.0.53.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS