CVE-2026-127204
HIGH
MEDIUM
Priority: 0.02
BB Relevance:
77/100
Published: 2026-11-12
Modified: 2026-11-12
First seen: 2026-11-12
Status: active
Attack Surface
Network
Low Complexity
No Auth
No Interaction
Integ. Impact
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
None
UI:
None
S:
X
AT:
None
VC:
None
VI:
High
VA:
None
Description
WooCommerce PayPal Pro Payment Gateway plugin before 4.1.1 contains an unauthenticated payment bypass vulnerability that allows remote attackers to mark unpaid orders as paid by exploiting the pp_capture_order AJAX handler, which is gated only by a public checkout nonce and fails to properly validate the PayPal capture response status. Attackers can supply a valid _paypal_order_id to trigger payment_complete() without verifying the capture status or amount, causing the store to fulfill goods or services that were never paid for and resulting in direct financial loss to the merchant.
Weakness Classification (1)
Affected Software (1)
| Vendor | Product | Version |
|---|---|---|
| wp.insider | Payment Gateway for PayPal Pro, PayPal Checkout & Subscriptions for WooCommerce | 0 < 4.1.1 |
References & Advisories (2)
third-party-advisory
release-notes
patch