PT-2026-3343 · WordPress · Payment Button For Paypal

Publicado 2026-01-17 · Atualizado 2026-01-17 · CVE-2025-14463

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions The Payment Button for PayPal plugin for WordPress versions prior to 1.2.3.41

Description The plugin exposes a public AJAX endpoint, wppaypalcheckout ajax process order, that processes checkout results without authentication or server-side verification of the PayPal transaction. This allows unauthenticated attackers to create arbitrary orders via direct POST requests to the endpoint, bypassing parameter validation. The plugin will also send purchase receipt emails to any supplied email address if email sending is enabled, potentially leading to order database corruption and unauthorized outgoing emails without a legitimate PayPal transaction.

Recommendations Update The Payment Button for PayPal plugin to a version later than 1.2.3.41.

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2025-14463

Produtos afetados

Payment Button For Paypal

Referências · 8

• https://plugins.trac.wordpress.org/browser/wp-paypal/trunk/wp-paypal-checkout.php#L249 · Nota
• https://wordfence.com/threat-intel/vulnerabilities/id/814e50de-3690-4adf-bc01-a63cd71bd1cf?source=cve · Nota
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3431974%40wp-paypal&new=3431974%40wp-paypal&sfp_email=&sfph_mail= · Nota
• https://twitter.com/CVEnew/status/2012490350498111625 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-14463 · Nota de Segurança
• https://plugins.trac.wordpress.org/browser/wp-paypal/tags/1.2.3.41/wp-paypal-checkout.php#L249 · Nota
• https://plugins.trac.wordpress.org/browser/wp-paypal/trunk/wp-paypal.php#L70 · Nota
• https://plugins.trac.wordpress.org/browser/wp-paypal/tags/1.2.3.41/wp-paypal.php#L70 · Nota