Unauthorized Order Manipulation in WooCommerce PayPal Payments Plugin for WordPress

CVE-2026-9284

What is CVE-2026-9284?

The WooCommerce PayPal Payments plugin for WordPress has a significant vulnerability that enables unauthorized manipulation of orders and potential exposure of sensitive information. Attackers can exploit missing authorization checks on the ppc-create-order and ppc-get-order WC-AJAX endpoints, present in all versions up to and including 4.0.1. By sending requests that include any WooCommerce order ID to the ppc-create-order endpoint, attackers can create PayPal orders without verifying the ownership of those orders. Additionally, the ppc-get-order endpoint can disclose full PayPal order details for any valid PayPal order ID, allowing unauthorized users to access sensitive payer information and shipping data. This vulnerability poses significant risks as it enables malicious actors to manipulate order payment flows and exfiltrate sensitive customer details.

References