Description

The Quick Paypal Payments WordPress plugin through 5.7.50 does not verify the paid amount, receiver, or payment status in its PayPal IPN handler and marks an order paid on an order-token match alone, so a buyer who pays an arbitrary small amount can have a full-price order marked paid.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-12T12:17:47.330Z",
  "pubdate": "2026-08-12T12:17:47.330Z",
  "executiveSummary": "The Quick Paypal Payments WordPress plugin through 5.7.50 suffers from an insufficient validation vulnerability within its PayPal Instant Payment Notification (IPN) handler.\nThe vulnerability allows remote unauthenticated attackers to manipulate payment processing by failing to cryptographically or logically verify critical transaction parameters, specifically the paid amount, the designated payment receiver, and the actual payment status.\nImpact includes financial loss, unauthorized acquisition of goods or services, and privilege escalation or order status tampering, as the system marks arbitrary orders as fully paid based solely on an order-token match.\nThe risk implication is critical for e-commerce platforms utilizing this software, enabling malicious buyers to execute arbitrary underpayment attacks.\nAttackers require no prior authentication or elevated privileges, needing only the ability to interact with the plugin's exposed network endpoints and transmit spoofed or manipulated IPN callback data reflecting an arbitrary small payment mapped to a legitimate high-value order token.",
  "technicalDetails": "The root cause of the vulnerability resides in the PayPal IPN handler component of the Quick Paypal Payments WordPress plugin, affecting versions up to and including 5.7.50.\nThe vulnerable component improperly processes incoming asynchronous HTTP POST callbacks from the payment gateway by relying strictly on the presence of a matching order-token parameter.\nDuring the IPN verification lifecycle, the software fails to validate core transactional integrity checks mandated by secure payment integration standards.\nSpecifically, the handler omits verification of the mc_gross or payment_amount variables against the expected order total, fails to confirm that the business email or receiver identifier matches the merchant account, and does not validate that the payment_status parameter equals 'Completed'.\nThe attack flow proceeds as follows: First, a malicious buyer initiates a checkout process for a high-value item within the WordPress environment, generating a valid order token.\nSecond, the buyer initiates a separate, arbitrary low-value transaction (e.g., one cent) via PayPal to generate a legitimate transaction context or directly crafts a malicious HTTP POST payload mimicking an IPN callback.\nThird, the attacker transmits the crafted IPN payload containing the valid high-value order token alongside the manipulated financial parameters directly to the plugin's exposed IPN listener endpoint over the network.\nUpon receiving the payload, the vulnerable plugin performs a superficial database lookup verifying only the existence of the order token.\nFinding a match, the application unconditionally transitions the order state to paid, completely bypassing cryptographic validation of the IPN message authenticity via the PayPal IPN Post-Back validation mechanism (such as using cURL to querycgi-bin/webscr with cmd=_notify-validate).\nPost-exploitation impact includes unauthorized fulfillment of goods, inventory depletion without proportional monetary compensation, and complete subversion of the e-commerce transaction validation layer without requiring network sniffing or man-in-the-middle positioning."
}