CVE-2026-92400
MediumCVSS 5.3Summary
The Payment Gateway for PayPal on WooCommerce WordPress plugin before 9.2.1 does not verify that an incoming payment notification was confirmed in the store's configured payment environment or paid to the store's own merchant account before marking an order complete. This allows unauthenticated users to mark their own orders as paid using a genuine transaction from a payment sandbox they control.
Risk Assessment
An attacker can obtain goods or services without making a real payment, leading to financial losses and store abuse. The risk affects any WooCommerce store using this plugin.
Recommendation
Update the Payment Gateway for PayPal on WooCommerce plugin to version 9.2.1 or later. Verify that the plugin correctly checks the payment environment and merchant account before marking an order as paid.
Other vulnerabilities in Payment Gateway for PayPal on WooCommerce
See all- CVE-2026-59547High
The Payment Gateway for PayPal on WooCommerce plugin up to version 9.1.4 contains an unauthenticated Broken Access Control vulnerability. An unauthenticated attacker can bypass authorization mechanisms and gain unauthorized access to functions or data.
- CVE-2026-16621Medium
The Payment Gateway for PayPal on WooCommerce WordPress plugin before 9.2.1 does not verify that payment actually succeeded before completing an order in its PayPal return handler: it reads attacker-controlled parameters, performs no amount comparison and no order-ownership check, and completes the order even when the server-side gateway verification fails, allowing an unauthenticated attacker to mark arbitrary orders as paid without paying.
Original NVD description (English source)
The Payment Gateway for PayPal on WooCommerce WordPress plugin before 9.2.1 does not verify that an incoming payment notification was confirmed in the store's configured payment environment or paid to the store's own merchant account before marking an order complete, allowing unauthenticated users to mark their own orders as paid using a genuine transaction from a payment sandbox they control.