{"id":"CVE-2026-127204","kind":"vulnerability","aliases":["CVE-2026-127204"],"related":[],"title":"WooCommerce PayPal Pro plugin: unpaid orders can be marked as paid","description":"WooCommerce PayPal Pro Payment Gateway plugin before 4.1.1 contains an unauthenticated payment bypass vulnerability that allows remote attackers to mark unpaid orders as paid by exploiting the pp_capture_order AJAX handler, which is gated only by a public checkout nonce and fails to properly validate the PayPal capture response status. Attackers can supply a valid _paypal_order_id to trigger payment_complete() without verifying the capture status or amount, causing the store to fulfill goods or services that were never paid for and resulting in direct financial loss to the merchant.","summary":"The WooCommerce PayPal Pro Payment Gateway plugin before 4.1.1 has an AJAX handler that does not check whether a PayPal capture succeeded or for the right amount. An unauthenticated remote attacker can mark unpaid orders as paid, so the store ships goods or services it was never paid for.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ecommerce","package","paypal","woocommerce","wordpress"],"not_affected_if":["plugin-not-installed","version-4.1.1-or-later"],"how_to_check":"- Check the installed version of the WooCommerce PayPal Pro Payment Gateway plugin in the WordPress admin Plugins screen; versions below `4.1.1` are affected.\n- Search the plugin directory for the `pp_capture_order` AJAX handler to confirm the code path is present.","fix":"- WooCommerce PayPal Pro Payment Gateway plugin: move to `4.1.1` or later.","status":"open","published_at":"2026-11-12T18:17:42+00:00","first_seen_at":"2026-11-12T18:40:39+00:00","triaged_at":"2026-11-12T18:42:41+00:00","updated_at":"2026-11-12T18:42:41+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-12T18:42:41Z","model":"claude-haiku-5-5","output":{"fix":"- WooCommerce PayPal Pro Payment Gateway plugin: move to `4.1.1` or later.","reach":"internet","title":"WooCommerce PayPal Pro plugin: unpaid orders can be marked as paid","impact":"high","summary":"The WooCommerce PayPal Pro Payment Gateway plugin before 4.1.1 has an AJAX handler that does not check whether a PayPal capture succeeded or for the right amount. An unauthenticated remote attacker can mark unpaid orders as paid, so the store ships goods or services it was never paid for.","audience":"businesses","category":"package","nicknames":[],"who_cares":["woocommerce","wordpress","paypal","ecommerce"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"Unpaid orders are marked paid and goods are shipped without payment","analyst_note":"Confirm the affected version range and whether the advisory at www.vulncheck.com names a fixed version beyond 4.1.1.","how_to_check":"- Check the installed version of the WooCommerce PayPal Pro Payment Gateway plugin in the WordPress admin Plugins screen; versions below `4.1.1` are affected.\n- Search the plugin directory for the `pp_capture_order` AJAX handler to confirm the code path is present.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","version-4.1.1-or-later"],"who_is_affected":"Online stores running the WooCommerce PayPal Pro Payment Gateway plugin before 4.1.1 that accept PayPal Pro payments on WooCommerce checkout. The flaw is reachable without an account, through the public checkout nonce, so any store with the plugin enabled should be treated as exposed. Stores not using this plugin, or on a version at or above 4.1.1, are not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00082,"input_tokens":4685,"output_tokens":703,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-127204':14A,17A '-2026':13A,16A '4.1.1':31B,78C 'ajax':34B,101C 'allow':86C 'amount':49B,140C 'attack':53B,88C,122C 'bypass':83C 'captur':43B,99C,119C,137C 'caus':141C 'check':39B 'checkout':110C 'complet':133C 'contain':79C 'cve':12A,15A 'direct':157C 'ecommerc':18B 'exploit':96C 'fail':113C 'financi':158C 'fulfil':145C 'gate':105C 'gateway':28B,75C 'good':64B,146C 'handler':35B,102C 'id':129C 'loss':159C 'mark':9A,55B,90C 'merchant':162C 'never':69B,151C 'nonc':111C 'order':6A,57B,92C,100C,128C 'packag':19B 'paid':11A,59B,70B,94C,152C 'payment':27B,74C,82C,132C 'paypal':2A,20B,25B,42B,72C,118C,127C 'plugin':4A,29B,76C 'pp':98C 'pro':3A,26B,73C 'proper':115C 'public':109C 'remot':52B,87C 'respons':120C 'result':155C 'right':48B 'servic':66B,148C 'ship':63B 'status':121C,138C 'store':62B,143C 'succeed':44B 'suppli':124C 'trigger':131C 'unauthent':51B,81C 'unpaid':5A,56B,91C 'valid':116C,126C 'verifi':135C 'vulner':84C 'whether':40B 'without':134C 'woocommerc':1A,21B,24B,71C 'wordpress':22B","nicknames":[],"mitigations":[],"who_affected":"Online stores running the WooCommerce PayPal Pro Payment Gateway plugin before 4.1.1 that accept PayPal Pro payments on WooCommerce checkout. The flaw is reachable without an account, through the public checkout nonce, so any store with the plugin enabled should be treated as exposed. Stores not using this plugin, or on a version at or above 4.1.1, are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ecommerce","high","package","paypal","woocommerce","wordpress"],"campaign_type":null,"search_a":"'-127204':14A,17A '-2026':13A,16A 'cve':12A,15A 'mark':9A 'order':6A 'paid':11A 'paypal':2A 'plugin':4A 'pro':3A 'unpaid':5A 'woocommerc':1A","search_b":"'4.1.1':31B 'ajax':34B 'amount':49B 'attack':53B 'captur':43B 'check':39B 'ecommerc':18B 'gateway':28B 'good':64B 'handler':35B 'mark':55B 'never':69B 'order':57B 'packag':19B 'paid':59B,70B 'payment':27B 'paypal':20B,25B,42B 'plugin':29B 'pro':26B 'remot':52B 'right':48B 'servic':66B 'ship':63B 'store':62B 'succeed':44B 'unauthent':51B 'unpaid':56B 'whether':40B 'woocommerc':21B,24B 'wordpress':22B","search_c":"'4.1.1':78C 'ajax':101C 'allow':86C 'amount':140C 'attack':88C,122C 'bypass':83C 'captur':99C,119C,137C 'caus':141C 'checkout':110C 'complet':133C 'contain':79C 'direct':157C 'exploit':96C 'fail':113C 'financi':158C 'fulfil':145C 'gate':105C 'gateway':75C 'good':146C 'handler':102C 'id':129C 'loss':159C 'mark':90C 'merchant':162C 'never':151C 'nonc':111C 'order':92C,100C,128C 'paid':94C,152C 'payment':74C,82C,132C 'paypal':72C,118C,127C 'plugin':76C 'pp':98C 'pro':73C 'proper':115C 'public':109C 'remot':87C 'respons':120C 'result':155C 'servic':148C 'status':121C,138C 'store':143C 'suppli':124C 'trigger':131C 'unauthent':81C 'unpaid':91C 'valid':116C,126C 'verifi':135C 'vulner':84C 'without':134C 'woocommerc':71C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T18:17:42+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-127204","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-127204","severity":null,"published_at":"2026-11-12T18:17:42+00:00","modified_at":"2026-11-12T18:17:42+00:00","first_seen_at":"2026-11-12T18:40:39+00:00","fetched_at":"2026-11-12T18:40:39+00:00","note":null}],"documents":[{"id":137490,"url":"https://www.vulncheck.com/advisories/woocommerce-paypal-pro-payment-gateway-payment-bypass-via-pp-capture-order","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}