Security Advisory

CVE-2026-16621

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-08-12 11:23:59

Last updated 2026-08-12 12:14:24

Assigner WPScan

CVSS score 5.3

State PUBLISHED

Description

The Payment Gateway for PayPal on WooCommerce WordPress plugin before 9.2.1 does not verify that payment actually succeeded before completing an order in its PayPal return handler: it reads attacker-controlled parameters, performs no amount comparison and no order-ownership check, and completes the order even when the server-side gateway verification fails, allowing an unauthenticated attacker to mark arbitrary orders as paid without paying.

← Browse all CVEs View on cve.org ↗