Live › vulnerability › CVE-2026-113468
Go to dashboardThe PayPal payment notification endpoint does not check that incoming data comes from the payment provider. Any site visitor can overwrite the stored payment notification of an order still awaiting payment with arbitrary content.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the shop's order plugin with the PayPal payment notification endpoint, where a page contains the order plugin. Orders that are already paid are not affected according to the description. The sources do not name the plugin or the affected versions.
No product ranges from the sources yet.
Unknown from the sources.
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The payment notification endpoint for PayPal accepts incoming data without verifying that it comes from the payment provider. Any site visitor can overwrite the stored payment notification of an order that is still awaiting payment with arbitrary content. This requires a page that contains the shop's order plugin. Orders that are already paid are not affected.
This page as .md · .json · in your agent: get_signal("CVE-2026-113468")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.