CVE-2026-16621
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
The Payment Gateway for PayPal on WooCommerce WordPress plugin before 9.2.1 does not verify that payment actually succeeded before completing an order in its PayPal return handler: it reads attacker-controlled parameters, performs no amount comparison and no order-ownership check, and completes the order even when the server-side gateway verification fails, allowing an unauthenticated attacker to mark arbitrary orders as paid without paying.
Risk Assessment
The risk includes order fulfillment without payment, leading to financial losses and abuse.
Recommendation
It is recommended to immediately update the plugin to version 9.2.1 or later and implement verification of payment status and order ownership.
Other vulnerabilities in Payment Gateway for PayPal on WooCommerce
See all- CVE-2026-59547High
The Payment Gateway for PayPal on WooCommerce plugin up to version 9.1.4 contains an unauthenticated Broken Access Control vulnerability. An unauthenticated attacker can bypass authorization mechanisms and gain unauthorized access to functions or data.
- CVE-2026-92400Medium
The Payment Gateway for PayPal on WooCommerce WordPress plugin before 9.2.1 does not verify that an incoming payment notification was confirmed in the store's configured payment environment or paid to the store's own merchant account before marking an order complete. This allows unauthenticated users to mark their own orders as paid using a genuine transaction from a payment sandbox they control.
- CVE-2025-63023Medium
The Payment Gateway for PayPal on WooCommerce plugin contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. The issue affects versions up to and including 9.0.53.
Original NVD description (English source)
The Payment Gateway for PayPal on WooCommerce WordPress plugin before 9.2.1 does not verify that payment actually succeeded before completing an order in its PayPal return handler: it reads attacker-controlled parameters, performs no amount comparison and no order-ownership check, and completes the order even when the server-side gateway verification fails, allowing an unauthenticated attacker to mark arbitrary orders as paid without paying.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS