Description

The Order Tracking WordPress plugin before 3.6.0 does not verify that a PayPal payment notification was sent to the merchant's account, or that its amount matches the order total, before marking an order as paid, which could allow unauthenticated attackers to mark arbitrary orders as paid using a trivial payment to their own PayPal account.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-11-06T08:17:19.967Z",
  "pubdate": "2026-11-06T08:17:19.967Z",
  "executiveSummary": "The Order Tracking WordPress plugin prior to version 3.6.0 is susceptible to an improper input validation vulnerability during the PayPal Instant Payment Notification (IPN) process. This security flaw allows unauthenticated remote attackers to manipulate the order fulfillment workflow by spoofing payment confirmation signals. By sending a crafted IPN request corresponding to a transaction made to an attacker-controlled PayPal account, an adversary can trick the system into marking arbitrary orders as 'paid' within the merchant's database. This vulnerability poses a significant business risk, as it permits the unauthorized acquisition of goods or services without actual payment to the merchant, leading to potential financial loss and inventory discrepancies. Exploitation does not require prior authentication or elevated privileges, as the listener endpoint is publicly accessible and lacks the necessary cryptographical validation mechanisms to ensure the integrity and authenticity of the incoming notification data.",
  "technicalDetails": "The vulnerability resides within the PayPal IPN handling component of the Order Tracking plugin. When a payment is processed via PayPal, the service sends an asynchronous POST request to the merchant's site, known as an Instant Payment Notification (IPN), to notify the application that a transaction status has changed. In affected versions prior to 3.6.0, the plugin fails to implement mandatory security verification checks, specifically the validation of the transaction recipient (receiver_email) and the verification of the transaction amount (mc_gross) against the expected order total stored in the database.\nThe exploitation flow is straightforward: an attacker identifies the target order number and the publicly accessible IPN listener endpoint. The attacker then initiates a separate, valid transaction for a nominal amount to their own PayPal account. Once PayPal sends an IPN to the attacker, the attacker captures the notification data. The attacker then constructs a forged HTTP POST request mimicking the structure of a legitimate PayPal IPN, but substitutes the transaction details with the target order's ID. Because the vulnerable code does not perform a secondary 'Post-Back' validation via the 'cmd=_notify-validate' handshake with PayPal's servers—or fails to compare the incoming payload against the specific transaction parameters associated with the Order Tracking system—the plugin accepts the spoofed data as legitimate.\nThe root cause is the absence of a server-to-server verification step. A secure implementation would require the plugin to send the received IPN data back to PayPal’s verification endpoint. Only upon receiving a 'VERIFIED' response should the plugin proceed to update the order status. Furthermore, the absence of checks confirming that the payment was sent to the merchant’s specific business email address allows attackers to use valid payment receipts from unrelated transactions to satisfy the plugin's logic. As a result, the application effectively trusts unauthenticated user input, leading to an insecure state where order statuses are updated without proof of payment to the merchant. This impact is critical as it bypasses the core financial integrity controls of the e-commerce workflow."
}