Description

The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.20 does not have proper authorization checks on a REST endpoint, allowing unauthenticated users to bypass payments

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-06T22:16:45.717Z",
  "pubdate": "2026-08-06T22:16:45.717Z",
  "executiveSummary": "The Payment Plugins for PayPal WooCommerce WordPress plugin before version 2.0.20 suffers from an improper authorization vulnerability residing within its REST API implementation. This security flaw enables unauthenticated remote attackers to interact directly with sensitive REST endpoints without validating user sessions, permissions, or transaction states.\nThe primary impact of this vulnerability is the capability for unauthorized actors to completely bypass the payment gateway verification process during the WooCommerce checkout flow. Consequently, malicious users can manipulate transaction logic, artificially marking orders as paid or successfully processed without executing actual financial transactions with PayPal.\nThe affected product is the Payment Plugins for PayPal WooCommerce plugin for WordPress across versions prior to 2.0.20. The risk implications are severe for merchants utilizing vulnerable installations, potentially resulting in direct financial loss, fulfillment of unpaid goods, and severe order integrity degradation.\nExploitation of this vulnerability requires network access to the target WordPress site hosting the vulnerable REST endpoint. No prior authentication, user interaction, or specific privilege level is required by the attacker to successfully execute the bypass.\nTo neutralize this security risk, administrators must immediately update the Payment Plugins for PayPal WooCommerce plugin to version 2.0.20 or later, ensuring that proper access control and authorization checks are enforced on all associated REST API routes.",
  "technicalDetails": "The vulnerability stems from the absence of proper authorization checks and capability validations within a specific REST API endpoint exposed by the Payment Plugins for PayPal WooCommerce plugin. REST endpoints in WordPress plugins typically rely on custom permission callbacks or nonce verifications to ensure that incoming requests originate from authorized contexts, such as an authenticated user with specific capabilities or a valid ongoing checkout session.\nIn versions prior to 2.0.20, the affected REST route fails to adequately authenticate the caller or verify whether the transaction parameters align with a legitimate, paid checkout state managed by the PayPal gateway integration. As a result, the backend application logic processes requests sent to the endpoint as authoritative confirmation of payment success without enforcing the necessary cryptographic or session-based validations.\nThe attack flow begins with an unauthenticated actor initiating a standard checkout process on a WooCommerce store utilizing the vulnerable plugin. Instead of completing the payment authorization flow through the official PayPal interface, the attacker crafts a direct HTTP request targeted at the unprotected REST endpoint associated with the plugin.\nBecause the endpoint lacks adequate authorization enforcement, the application interprets the incoming payload as a valid callback or state-change request from the payment gateway. The server processes the request, updates the WooCommerce order status from pending to processing or completed, and triggers downstream fulfillment processes as if a legitimate financial transaction had occurred.\nThe vulnerable component is the REST API request handler responsible for processing payment responses or state updates within the Payment Plugins for PayPal WooCommerce plugin. The affected versions include all releases prior to 2.0.20. The vulnerability is exploitable remotely over the network via standard HTTP/HTTPS requests without requiring any pre-existing authentication credentials or elevated privileges on the WordPress site."
}