Unauthenticated Payment Bypass in WooCommerce PayPal Pro Payment Gateway
CVE-2026-127204

8.7HIGH

Key Information:

Vendor

WP.insider

Status
Payment Gateway For Paypal Pro, Paypal Checkout & Subscriptions For WooCommerce
Vendor
CVE Published:
12 November 2026

What is CVE-2026-127204?

The WooCommerce PayPal Pro Payment Gateway plugin prior to version 4.1.1 is susceptible to a payment bypass vulnerability. This issue allows remote attackers to exploit the pp_capture_order AJAX handler, which is inadequately secured by merely a public checkout nonce. Attackers can manipulate it by providing a valid _paypal_order_id to invoke the payment_complete() function without correctly validating the PayPal capture response. This flaw may lead to unauthorized fulfillment of goods or services without actual payment being processed, causing financial detriment to merchants.

Affected Version(s)

Payment Gateway for PayPal Pro, PayPal Checkout & Subscriptions for WooCommerce 0 < 4.1.1

References

https://wordpress.org/plugins/woocommerce-paypal-pro-paym...
release-notespatch
https://www.vulncheck.com/advisories/woocommerce-paypal-p...
third-party-advisory

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

buiih
.