CVE-2026-16621 — Payment Gateway for PayPal on WooCommerce < 9.2.1 - Unauthenticated Payment Bypass via PayPal Advanced Return Handler

CVE-2026-16621

Payment Gateway for PayPal on WooCommerce < 9.2.1 - Unauthenticated Payment Bypass via PayPal Advanced Return Handler PUBLISHED

Description (CNA)

The Payment Gateway for PayPal on WooCommerce WordPress plugin before 9.2.1 does not verify that payment actually succeeded before completing an order in its PayPal return handler: it reads attacker-controlled parameters, performs no amount comparison and no order-ownership check, and completes the order even when the server-side gateway verification fails, allowing an unauthenticated attacker to mark arbitrary orders as paid without paying.

Affected (CNA)

Vendor / product	Versions
Unknown / Payment Gateway for PayPal on WooCommerce	affected 0 before 9.2.1

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/76c4cff2-1166-45fe-9517-5eda2d24c35d/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.