Description

The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.27 does not verify that a PayPal order supplied in a payment request belongs to the WooCommerce order being paid unless that PayPal order has already been completed, allowing unauthenticated attackers to have another buyer's approved but uncaptured payment captured against an order of their own.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-23T06:17:02.040Z",
  "pubdate": "2026-09-23T06:17:02.040Z",
  "executiveSummary": "The Payment Plugins for PayPal WooCommerce WordPress plugin prior to version 2.0.27 is susceptible to a critical payment validation vulnerability. The flaw originates from an improper authorization check during the payment request process, specifically failing to enforce an ownership binding between a provided PayPal order ID and the associated WooCommerce transaction.\nThis vulnerability allows an unauthenticated attacker to associate a previously approved, but not yet captured, PayPal payment belonging to a different user with their own fraudulent or separate WooCommerce order. Consequently, an attacker can manipulate the payment fulfillment workflow to capture funds intended for another transaction, resulting in unauthorized product acquisition or financial discrepancy.\nThe risk is severe as it undermines the integrity of the payment processing logic within the WooCommerce checkout flow. Since this does not require administrative privileges and can be executed by any remote, unauthenticated user, it poses a direct threat to the financial security of the merchant and the platform's transaction integrity. Exploitation relies on the attacker obtaining a target's uncaptured PayPal order identifier and injecting it into their own session checkout request, allowing the plugin to erroneously process the external order as legitimate for the attacker's cart.",
  "technicalDetails": "The root cause of this vulnerability lies in an insufficient validation of order association during the PayPal payment processing sequence. The plugin fails to verify the cryptographically or session-bound relationship between the 'PayPal Order ID' submitted via the payment request and the specific 'WooCommerce Order ID' being processed, unless the PayPal order is already in a 'completed' state.\nIn the standard payment workflow, when a user initiates a PayPal transaction, an order is generated. If the transaction is approved but not immediately captured, the PayPal order ID remains valid for capture operations. The vulnerability exists because the plugin's verification logic assumes that any provided PayPal order ID—if not yet completed—is implicitly valid for the current cart/order transaction. This lack of strict validation allows an attacker to manipulate the request parameters.\nThe attack flow follows these steps: First, an attacker initiates a checkout on the merchant's site and captures the request to the payment gateway. Second, the attacker obtains a valid, uncaptured PayPal Order ID, which may have been intercepted from another user or generated through parallel session manipulation. Third, the attacker substitutes their legitimate PayPal Order ID with the target's uncaptured Order ID within the payload of the payment request. Fourth, the plugin receives this request, fails to check that the target PayPal order belongs to the attacker's WooCommerce order ID, and proceeds to authorize or capture the funds from the target's payment session.\nThe vulnerable component is the server-side validation logic responsible for mapping and confirming payment intent against specific WooCommerce transaction objects. Because this occurs at the API or backend request handler level of the plugin, it is fully accessible to remote, unauthenticated attackers who can craft HTTP requests to the payment endpoint. Post-exploitation, the attacker successfully triggers the fulfillment logic in WooCommerce, effectively 'stealing' the payment captured from the victim's PayPal account to satisfy their own order. This results in the attacker receiving goods or services for free, while the victim's account is charged for a transaction they did not authorize for that specific merchant checkout session. The scope of impact is limited to the payment capture phase, meaning the plugin's security depends heavily on the strict server-side validation of the order ownership during every request to the PayPal gateway."
}