Detections
Analytics
CVE-2026-16621
medium
Description
The Payment Gateway for PayPal on WooCommerce WordPress plugin before 9.2.1 does not verify that payment actually succeeded before completing an order in its PayPal return handler: it reads attacker-controlled parameters, performs no amount comparison and no order-ownership check, and completes the order even when the server-side gateway verification fails, allowing an unauthenticated attacker to mark arbitrary orders as paid without paying.
References
https://wpscan.com/vulnerability/76c4cff2-1166-45fe-9517-5eda2d24c35d/