{"id":"CVE-2026-121633","kind":"vulnerability","aliases":["CVE-2026-121633"],"related":[],"title":"Order Tracking WordPress plugin lets attackers mark unpaid orders as paid","description":"The Order Tracking WordPress plugin before 3.6.0 does not verify that a PayPal payment notification was sent to the merchant's account, or that its amount matches the order total, before marking an order as paid, which could allow unauthenticated attackers to mark arbitrary orders as paid using a trivial payment to their own PayPal account.","summary":"The Order Tracking WordPress plugin before 3.6.0 does not check that a PayPal payment notification was sent to the merchant's account or that the amount matches the order total. An unauthenticated attacker can mark any order as paid by sending a trivial payment to their own PayPal account.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["e-commerce","package","paypal","woocommerce","wordpress"],"not_affected_if":["paypal-not-used","plugin-version-3.6.0-or-later"],"how_to_check":"- Check the installed version of the Order Tracking plugin in the WordPress admin under Plugins; versions below `3.6.0` are affected.\n- Review orders marked as paid whose PayPal amounts do not match the order totals.","fix":"- Order Tracking WordPress plugin: move to `3.6.0` or later.","status":"open","published_at":"2026-11-06T08:17:19+00:00","first_seen_at":"2026-11-06T08:40:33+00:00","triaged_at":"2026-11-06T08:42:40+00:00","updated_at":"2026-11-06T08:42:40+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-06T08:42:40Z","model":"claude-haiku-5-5","output":{"fix":"- Order Tracking WordPress plugin: move to `3.6.0` or later.","reach":"internet","title":"Order Tracking WordPress plugin lets attackers mark unpaid orders as paid","impact":"medium","summary":"The Order Tracking WordPress plugin before 3.6.0 does not check that a PayPal payment notification was sent to the merchant's account or that the amount matches the order total. An unauthenticated attacker can mark any order as paid by sending a trivial payment to their own PayPal account.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","paypal","e-commerce"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"unpaid orders are marked paid without payment","analyst_note":"","how_to_check":"- Check the installed version of the Order Tracking plugin in the WordPress admin under Plugins; versions below `3.6.0` are affected.\n- Review orders marked as paid whose PayPal amounts do not match the order totals.","plain_action":"","needs_analyst":false,"not_affected_if":["plugin-version-3.6.0-or-later","paypal-not-used"],"who_is_affected":"Merchants running the Order Tracking WordPress plugin before 3.6.0 that accept PayPal payments. The flaw sits in the payment notification handling, so any site using PayPal with this plugin is exposed to unauthenticated order tampering. Sites without this plugin or on 3.6.0 or later are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000708,"input_tokens":4239,"output_tokens":568,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-121633':14A,17A '-2026':13A,16A '3.6.0':31B,80C 'account':46B,73B,95C,129C 'allow':112C 'amount':50B,99C 'arbitrari':117C 'attack':6A,57B,114C 'check':34B 'commerc':20B 'could':111C 'cve':12A,15A 'e':19B 'e-commerc':18B 'let':5A 'mark':7A,59B,105C,116C 'match':51B,100C 'merchant':44B,93C 'notif':39B,88C 'order':1A,9A,26B,53B,61B,75C,102C,107C,118C 'packag':21B 'paid':11A,63B,109C,120C 'payment':38B,68B,87C,124C 'paypal':22B,37B,72B,86C,128C 'plugin':4A,29B,78C 'send':65B 'sent':41B,90C 'total':54B,103C 'track':2A,27B,76C 'trivial':67B,123C 'unauthent':56B,113C 'unpaid':8A 'use':121C 'verifi':83C 'woocommerc':23B 'wordpress':3A,24B,28B,77C","nicknames":[],"mitigations":[],"who_affected":"Merchants running the Order Tracking WordPress plugin before 3.6.0 that accept PayPal payments. The flaw sits in the payment notification handling, so any site using PayPal with this plugin is exposed to unauthenticated order tampering. Sites without this plugin or on 3.6.0 or later are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ecommerce","medium","package","paypal","woocommerce","wordpress"],"campaign_type":null,"search_a":"'-121633':14A,17A '-2026':13A,16A 'attack':6A 'cve':12A,15A 'let':5A 'mark':7A 'order':1A,9A 'paid':11A 'plugin':4A 'track':2A 'unpaid':8A 'wordpress':3A","search_b":"'3.6.0':31B 'account':46B,73B 'amount':50B 'attack':57B 'check':34B 'commerc':20B 'e':19B 'e-commerc':18B 'mark':59B 'match':51B 'merchant':44B 'notif':39B 'order':26B,53B,61B 'packag':21B 'paid':63B 'payment':38B,68B 'paypal':22B,37B,72B 'plugin':29B 'send':65B 'sent':41B 'total':54B 'track':27B 'trivial':67B 'unauthent':56B 'woocommerc':23B 'wordpress':24B,28B","search_c":"'3.6.0':80C 'account':95C,129C 'allow':112C 'amount':99C 'arbitrari':117C 'attack':114C 'could':111C 'mark':105C,116C 'match':100C 'merchant':93C 'notif':88C 'order':75C,102C,107C,118C 'paid':109C,120C 'payment':87C,124C 'paypal':86C,128C 'plugin':78C 'sent':90C 'total':103C 'track':76C 'trivial':123C 'unauthent':113C 'use':121C 'verifi':83C 'wordpress':77C","first_public_at":"2026-11-06T08:17:19+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cvss_by":"contact@wpscan.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121633","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121633","severity":null,"published_at":"2026-11-06T08:17:19+00:00","modified_at":"2026-11-06T08:17:19+00:00","first_seen_at":"2026-11-06T08:40:33+00:00","fetched_at":"2026-11-06T08:40:33+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}