CVE-2026-127204
WooCommerce PayPal Pro Payment Gateway < 4.1.1 Payment Bypass via pp_capture_order
WooCommerce PayPal Pro Payment Gateway plugin before 4.1.1 contains an unauthenticated payment bypass vulnerability that allows remote attackers to mark unpaid orders as paid by exploiting the pp_capture_order AJAX handler, which is gated only by a public checkout nonce and fails to properly validate the PayPal capture response status. Attackers can supply a valid _paypal_order_id to trigger payment_complete() without verifying the capture status or amount, causing the store to fulfill goods or services that were never paid for and resulting in direct financial loss to the merchant.
| CWE | CWE-345 |
| Vendor | wp.insider |
| Product | payment gateway for paypal pro, paypal checkout & subscriptions for woocommerce |
| Published | Nov 12, 2026 |
Get instant alerts for wp.insider payment gateway for paypal pro, paypal checkout & subscriptions for woocommerce
Be the first to know when new high vulnerabilities affecting wp.insider payment gateway for paypal pro, paypal checkout & subscriptions for woocommerce are published — delivered to Slack, Telegram or Discord.
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N