Description

The Subscriptions for WooCommerce WordPress plugin before 2.0.1 does not validate the payment amount or bind the PayPal order token to the order being completed on the WooCommerce order-received flow: it captures a client-supplied token and marks the order paid whenever the capture status is COMPLETED, without comparing the captured amount to the order total. This allows an attacker (unauthenticated where guest checkout is enabled) to substitute an approved, uncaptured PayPal order token and have an expensive order marked paid without paying its price.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.9",
  "pubDate": "2026-08-07T08:16:45.780Z",
  "pubdate": "2026-08-07T08:16:45.780Z",
  "executiveSummary": "A critical business logic vulnerability exists in the Subscriptions for WooCommerce WordPress plugin before version 2.0.1, specifically within the WooCommerce order-received payment flow.\nThe vulnerability arises from a failure to validate the payment amount and a failure to cryptographically or logically bind the PayPal order token to the specific order being processed.\nAn attacker can exploit this flaw by supplying an arbitrary, approved but uncaptured PayPal order token generated from a transaction of a much smaller value.\nWhen the payment capture status returns as COMPLETED, the application marks the high-value order as fully paid without verifying that the captured funds match the actual order total.\nThis flaw allows unauthenticated attackers—provided that guest checkout is enabled—to acquire expensive items or subscriptions illicitly without paying the correct price, leading to direct financial loss.\nThe risk implication is severe, as it undermines the integrity of the e-commerce transaction workflow and bypasses financial validation controls entirely.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper handling and validation of payment gateway callbacks and tokens during the WooCommerce order-received flow within the Subscriptions for WooCommerce plugin.\nSpecifically, the vulnerable component processes a client-supplied PayPal order token and invokes a capture routine, trusting the COMPLETED status returned by the payment processor without performing server-side validation against the expected order total.\nThe application fails to implement a secure binding mechanism between the PayPal order token and the internal WooCommerce order ID, allowing tokens to be decoupled and reused across disparate transaction contexts.\nThe exploitation method relies on parameter manipulation during the checkout or order-received phase. An attacker initiates two distinct transactions: one legitimate, low-cost transaction to obtain an approved PayPal order token, and one high-value target order.\nThe attack flow proceeds as follows: First, the attacker obtains an approved, uncaptured PayPal order token from a minor purchase. Second, during the checkout or order completion phase of an expensive subscription or product, the attacker intercepts or supplies the previously acquired low-value PayPal order token to the vulnerable order-received endpoint.\nThird, the plugin captures the client-supplied token. Upon receiving a COMPLETED status from the PayPal API, the plugin blindly trusts the response, marks the expensive order as paid and processed, and grants access to the goods or subscription.\nBecause the plugin omits any server-side comparison between the captured monetary amount and the targeted WooCommerce order total, the payment discrepancy goes unnoticed.\nNetwork exposure is remote, as the vulnerable functionality is exposed via web interfaces accessible over HTTP/HTTPS.\nAuthentication requirements depend on store configuration; if guest checkout is enabled, the vulnerability can be exploited by unauthenticated external threat actors. Privilege requirements are nonexistent for the initial exploitation vector under guest checkout conditions.\nThe post-exploitation impact includes unauthorized financial acquisition of goods and services, revenue loss for merchants, and potential manipulation of recurring subscription billing cycles."
}