Description

The Payment Gateway for PayPal on WooCommerce WordPress plugin before 9.2.1 does not verify that an incoming payment notification was confirmed in the store's configured payment environment or paid to the store's own merchant account before marking an order complete, allowing unauthenticated users to mark their own orders as paid using a genuine transaction from a payment sandbox they control.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-21T09:17:06.270Z",
  "pubdate": "2026-09-21T09:17:06.270Z",
  "executiveSummary": "The Payment Gateway for PayPal for WooCommerce plugin, specifically versions prior to 9.2.1, suffers from a critical broken access control and payment validation vulnerability. This flaw allows unauthenticated attackers to manipulate the payment confirmation process for online orders.\nThe vulnerability stems from the plugin's failure to verify that incoming Instant Payment Notifications (IPN) or webhook callbacks originate from the merchant's legitimate account or the correctly configured payment environment. Consequently, an attacker can supply a cryptographically valid notification triggered by a transaction in their own controlled sandbox environment to satisfy the plugin's verification checks.\nThe impact of this vulnerability is severe, as it facilitates unauthorized order fulfillment. Attackers can mark orders as 'paid' without transferring actual funds to the merchant's account. This leads to direct financial loss and inventory depletion for the affected store. The exploit requires no authentication or administrative privileges, as the listener endpoint for payment notifications is publicly accessible and inadequately guarded against transaction origin verification. Mitigation requires an immediate update to version 9.2.1 or later to implement strict server-side validation of transaction identifiers and merchant account association.",
  "technicalDetails": "The core vulnerability lies within the plugin's payment notification processing logic, which acts as the hook for PayPal IPN messages. The component responsible for receiving and processing these callbacks fails to perform a cross-reference validation between the transaction details received in the notification payload and the specific merchant identity (e.g., Merchant ID or API credentials) associated with the store's configured WooCommerce environment.\nThe exploitation flow begins with an attacker initiating a purchase on the target store to obtain a valid Order ID. Subsequently, the attacker creates a corresponding transaction within their own external PayPal Sandbox account. When the attacker triggers a payment notification from their sandbox environment, they point the payload toward the target site's payment listener URL.\nBecause the vulnerable plugin component does not enforce a strict check to ensure that the 'receiver_email' or 'merchant_id' field in the incoming notification matches the store's configured account, the plugin logic accepts the transaction as valid. Upon receiving the payload, the plugin validates the integrity of the message (checking if it is a genuine PayPal communication) but fails to perform business-logic validation to confirm that the funds were indeed deposited into the merchant's specified account.\nThe vulnerable code segment prematurely updates the WooCommerce order status to 'Processing' or 'Completed' upon receipt of a technically valid callback. Since the plugin relies on the notification to trigger status changes, the attacker effectively bypasses the payment gateway's security boundary. This is an unauthenticated vector, as the callback endpoint is necessarily exposed to the public internet to facilitate asynchronous communication from the payment processor.\nSuccessful exploitation results in unauthorized state transitions within the database, effectively completing the order fulfillment process for the attacker. Post-exploitation, the merchant faces a fraudulent order entry that appears legitimate within the WooCommerce dashboard, potentially triggering automated shipping or digital delivery systems. The vulnerability exists across all versions prior to 9.2.1 and requires no interaction from the shop administrator, as the malicious notification is processed automatically upon hitting the listener endpoint."
}