---
id: "CVE-2026-121633"
page: "https://infrastack.ai/live/CVE-2026-121633"
kind: "vulnerability"
aliases: ["CVE-2026-121633"]
title: "Order Tracking WordPress plugin lets attackers mark unpaid orders as paid"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["e-commerce", "package", "paypal", "woocommerce", "wordpress"]
not_affected_if: ["paypal-not-used", "plugin-version-3.6.0-or-later"]
published_at: "2026-11-06T08:17:19+00:00"
first_seen_at: "2026-11-06T08:40:33+00:00"
updated_at: "2026-11-06T08:42:40+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121633", "first_seen_at": "2026-11-06T08:40:33+00:00"}]
exploit_sources: []
---

# Order Tracking WordPress plugin lets attackers mark unpaid orders as paid

Link for people: https://infrastack.ai/live/CVE-2026-121633 (this .md is for agents)

The Order Tracking WordPress plugin before 3.6.0 does not check that a PayPal payment notification was sent to the merchant's account or that the amount matches the order total. An unauthenticated attacker can mark any order as paid by sending a trivial payment to their own PayPal account.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of the Order Tracking plugin in the WordPress admin under Plugins; versions below `3.6.0` are affected.
- Review orders marked as paid whose PayPal amounts do not match the order totals.

## Fix

- Order Tracking WordPress plugin: move to `3.6.0` or later.

## Timeline

- 2026-11-06T08:40:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121633

## From the sources

The Order Tracking WordPress plugin before 3.6.0 does not verify that a PayPal payment notification was sent to the merchant's account, or that its amount matches the order total, before marking an order as paid, which could allow unauthenticated attackers to mark arbitrary orders as paid using a trivial payment to their own PayPal account.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_