Vulnerability in PayPal Integration for WordPress Subscription Products
CVE-2025-12752
5.3MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 22 November 2025
What is CVE-2025-12752?
The Subscriptions & Memberships for PayPal plugin for WordPress is susceptible to a flaw that allows unauthorized attackers to generate fake payment records. This vulnerability arises from a failure to verify the authenticity of Incoming Payment Notifications (IPNs) correctly. As a result, attackers can exploit this weakness in all versions up to and including 1.1.7, leading to potential financial discrepancies and undermining the reliability of the payment processing system.
Affected Version(s)
Subscriptions & Memberships for PayPal * <= 1.1.7