{"id":"CVE-2026-113468","kind":"vulnerability","aliases":["CVE-2026-113468"],"related":[],"title":"PayPal payment notification endpoint accepts unverified data from any visitor","description":"The payment notification endpoint for PayPal accepts incoming data without verifying that it comes from the payment provider. Any site visitor can overwrite the stored payment notification of an order that is still awaiting payment with arbitrary content. This requires a page that contains the shop's order plugin. Orders that are already paid are not affected.","summary":"The PayPal payment notification endpoint does not check that incoming data comes from the payment provider. Any site visitor can overwrite the stored payment notification of an order still awaiting payment with arbitrary content.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ecommerce","paypal","vendor","wordpress-or-shop-plugin"],"not_affected_if":["no-paypal-payment","orders-already-paid"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-20T10:17:05+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","triaged_at":"2026-10-25T03:40:30+00:00","updated_at":"2026-10-25T03:40:30+00:00","category":"vendor","confidence":0.5,"triage":{"at":"2026-10-25T03:40:30Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"PayPal payment notification endpoint accepts unverified data from any visitor","impact":"medium","summary":"The PayPal payment notification endpoint does not check that incoming data comes from the payment provider. Any site visitor can overwrite the stored payment notification of an order still awaiting payment with arbitrary content.","category":"vendor","nicknames":[],"who_cares":["paypal","ecommerce","wordpress-or-shop-plugin"],"confidence":0.5,"needs_auth":"no","worst_case":"Attacker overwrites stored payment notification data for unpaid orders","analyst_note":"Identify the affected shop plugin, its vulnerable versions and fixed release from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-113468.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["orders-already-paid","no-paypal-payment"],"who_is_affected":"Sites running the shop's order plugin with the PayPal payment notification endpoint, where a page contains the order plugin. Orders that are already paid are not affected according to the description. The sources do not name the plugin or the affected versions.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000558,"input_tokens":3318,"output_tokens":452,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-113468':13A,16A '-2026':12A,15A 'accept':5A,65C 'affect':115C 'alreadi':111C 'arbitrari':57B,95C 'await':54B,92C 'check':32B 'come':36B,72C 'contain':102C 'content':58B,96C 'cve':11A,14A 'data':7A,35B,67C 'ecommerc':17B 'endpoint':4A,29B,62C 'incom':34B,66C 'notif':3A,28B,49B,61C,85C 'order':52B,88C,106C,108C 'overwrit':45B,81C 'page':100C 'paid':112C 'payment':2A,27B,39B,48B,55B,60C,75C,84C,93C 'paypal':1A,18B,26B,64C 'plugin':24B,107C 'provid':40B,76C 'requir':98C 'shop':23B,104C 'site':42B,78C 'still':53B,91C 'store':47B,83C 'unverifi':6A 'vendor':19B 'verifi':69C 'visitor':10A,43B,79C 'without':68C 'wordpress':21B 'wordpress-or-shop-plugin':20B","nicknames":[],"mitigations":[],"who_affected":"Sites running the shop's order plugin with the PayPal payment notification endpoint, where a page contains the order plugin. Orders that are already paid are not affected according to the description. The sources do not name the plugin or the affected versions.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T10:17:05+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"f4fb688c-4412-4426-b4b8-421ecf27b14a","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113468","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113468","severity":null,"published_at":"2026-10-20T10:17:05+00:00","modified_at":"2026-10-20T19:28:52+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}