← CVE Intelligence

CVE-2026-16990

Payment Button for PayPal <= 1.2.3.44 - Unauthenticated Payment Price Manipulation PUBLISHED

Description (CNA)

The Payment Button for PayPal WordPress plugin through 1.2.3.44 does not enforce the merchant-configured price server-side and trusts a client-supplied payment amount, allowing unauthenticated attackers to create a real PayPal order against the merchant for an arbitrary lower amount.

Affected (CNA)

Vendor / productVersions
Unknown / Payment Button for PayPalaffected 0 through 1.2.3.44

CWE

No CWE identifiers supplied.

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.