PT-2025-11699 · Unknown · Syliud Paypal Plugin

Published 2025-03-19 · Updated 2025-03-19 · CVE-2025-30152

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Syliud PayPal Plugin versions prior to 1.6.2 Syliud PayPal Plugin versions prior to 1.7.2 Syliud PayPal Plugin versions prior to 2.0.2

Description A discovered issue allows users to modify their shopping cart after completing the PayPal Checkout process and payment authorization. If a user initiates a PayPal transaction from a product page or the cart page and then returns to the order summary page, they can still manipulate the cart contents before finalizing the order. This can lead to a scenario where merchants deliver products or services without full payment.

Recommendations For versions prior to 1.6.2, update to version 1.6.2 or above. For versions prior to 1.7.2, update to version 1.7.2 or above. For versions prior to 2.0.2, update to version 2.0.2 or above.

Exploit

Fix

Weakness Enumeration

CWE-472

Related Identifiers

CVE-2025-30152

GHSA-HXG4-65P5-9W37

Affected Products

Syliud Paypal Plugin

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/30xxx/CVE-2025-30152.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-30152 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-hxg4-65p5-9w37 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-30152 · Security Note
• https://github.com/Sylius/PayPalPlugin/security/advisories/GHSA-hxg4-65p5-9w37 · Note
• https://github.com/Sylius/PayPalPlugin/commit/5613df827a6d4fc50862229295976200a68e97aa · Note
• https://github.com/Sylius/PayPalPlugin · Note
• https://t.me/cvetracker/19452 · Telegram Post
• https://t.me/cvedetector/20643 · Telegram Post
• https://twitter.com/CVEnew/status/1902394186764324919 · Twitter Post