Description

The Payment Button for PayPal WordPress plugin through 1.2.3.44 does not enforce the merchant-configured price server-side and trusts a client-supplied payment amount, allowing unauthenticated attackers to create a real PayPal order against the merchant for an arbitrary lower amount.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-12T12:17:47.210Z",
  "pubdate": "2026-08-12T12:17:47.210Z",
  "executiveSummary": "The Payment Button for PayPal WordPress plugin through version 1.2.3.44 suffers from an insecure payment validation vulnerability stemming from a lack of server-side price enforcement.\nThe vulnerability allows unauthenticated remote attackers to manipulate transaction parameters by supplying arbitrary payment amounts via the client-side request.\nBy bypassing the merchant-configured pricing logic, malicious actors can generate legitimate PayPal orders for significantly lower amounts than intended.\nThis introduces severe financial risk to merchants utilizing the affected plugin, as orders can be successfully processed and fulfilled at fraudulent price points without requiring elevated privileges or prior authentication.\nThe core deficiency lies in trusting client-supplied transaction data rather than recalculating or verifying the price against a trusted server-side inventory or database source during the checkout initialization phase.",
  "technicalDetails": "The vulnerability resides within the payment processing mechanism of the Payment Button for PayPal WordPress plugin, specifically affecting versions through 1.2.3.44.\nThe root cause of the flaw is inadequate input validation and the absence of server-side price verification. During the transaction initiation phase, the plugin relies on client-supplied data to determine the final payment amount transmitted to the payment gateway API.\nBecause the merchant-configured price is not enforced or recalculated on the server side, an attacker can intercept or craft HTTP requests destined for the plugin's payment endpoint.\nThe step-by-step attack flow proceeds as follows: First, the attacker identifies a target product or service utilizing the vulnerable plugin and initiates a checkout action. Second, the attacker intercepts the client-side request containing the transaction parameters, specifically locating the parameter responsible for carrying the monetary value. Third, the attacker modifies this parameter to an arbitrary lower value, such as a fraction of a cent or a nominal currency unit. Fourth, the modified payload is submitted to the server, which blindly accepts the client-provided amount and communicates directly with the PayPal API to generate a checkout session or order.\nBecause the transaction request sent to PayPal originates from the server using the manipulated amount, a valid payment session is created against the merchant's PayPal account for the fraudulent price. Once the victimized customer or the attacker completes the transaction through the generated payment button, the merchant receives a confirmed order for the arbitrary lower amount.\nThe vulnerability requires no authentication or privileges, meaning any unauthenticated user with network access to the WordPress site can execute the attack. The attack surface is exposed over standard web protocols (HTTP/HTTPS) as part of the plugin's standard public-facing payment functionality."
}