CVE-2026-16621 | BDVDB-2026-358213 Detail

Description#

The Payment Gateway for PayPal on WooCommerce WordPress plugin before 9.2.1 does not verify that payment actually succeeded before completing an order in its PayPal return handler: it reads attacker-controlled parameters, performs no amount comparison and no order-ownership check, and completes the order even when the server-side gateway verification fails, allowing an unauthenticated attacker to mark arbitrary orders as paid without paying.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-08-12Record published in the CVE List.