CVE-2026-59547

HighCVSS 7.5

Published: 23/07/2026(UTC)Updated: 23/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Summary

The Payment Gateway for PayPal on WooCommerce plugin up to version 9.1.4 contains an unauthenticated Broken Access Control vulnerability. An unauthenticated attacker can bypass authorization mechanisms and gain unauthorized access to functions or data.

Risk Assessment

The risk includes unauthorized access to sensitive functions or data, which may lead to confidentiality and integrity breaches.

Recommendation

Immediately update the Payment Gateway for PayPal on WooCommerce plugin to the latest available version that fixes this vulnerability.

Other vulnerabilities in Payment Gateway for PayPal on WooCommerce

CVE-2026-16621Medium
The Payment Gateway for PayPal on WooCommerce WordPress plugin before 9.2.1 does not verify that payment actually succeeded before completing an order in its PayPal return handler: it reads attacker-controlled parameters, performs no amount comparison and no order-ownership check, and completes the order even when the server-side gateway verification fails, allowing an unauthenticated attacker to mark arbitrary orders as paid without paying.

Original NVD description (English source)

Unauthenticated Broken Access Control in Payment Gateway for PayPal on WooCommerce <= 9.1.4 versions.