---
id: "CVE-2026-113468"
kind: "vulnerability"
aliases: ["CVE-2026-113468"]
title: "PayPal payment notification endpoint accepts unverified data from any visitor"
severity: "medium"
cvss: 6.9
epss: null
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["ecommerce", "paypal", "vendor", "wordpress-or-shop-plugin"]
not_affected_if: ["no-paypal-payment", "orders-already-paid"]
published_at: "2026-10-20T10:17:05+00:00"
first_seen_at: "2026-10-23T21:57:20+00:00"
updated_at: "2026-10-25T03:40:30+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113468", "first_seen_at": "2026-10-23T21:57:20+00:00"}]
---

# PayPal payment notification endpoint accepts unverified data from any visitor

The PayPal payment notification endpoint does not check that incoming data comes from the payment provider. Any site visitor can overwrite the stored payment notification of an order still awaiting payment with arbitrary content.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-10-23T21:57:20+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-113468

## From the sources

The payment notification endpoint for PayPal accepts incoming data without verifying that it comes from the payment provider. Any site visitor can overwrite the stored payment notification of an order that is still awaiting payment with arbitrary content. This requires a page that contains the shop's order plugin. Orders that are already paid are not affected.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_