CVE-2026-17012
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
The Accept PayPal & Stripe with Subscriptions for WooCommerce WordPress plugin through version 3.1.0 does not verify that the PayPal account which received a payment matches the merchant's configured account before marking the order as paid, allowing unauthenticated buyers to complete a WooCommerce order by paying the full amount to their own PayPal account instead of the merchant's.
Risk Assessment
Fraud risk – buyers can fake payment without actually transferring funds to the merchant, leading to financial losses and order fulfillment issues.
Recommendation
Update the plugin and implement verification of the PayPal recipient account before marking orders as paid.
Original NVD description (English source)
The Accept PayPal & Stripe with Subscriptions for WooCommerce WordPress plugin through 3.1.0 does not verify that the PayPal account which received a payment matches the merchant's configured account before marking the order as paid, allowing unauthenticated buyers to complete a WooCommerce order by paying the full amount to their own PayPal account instead of the merchant's.