PT-2026-3343 · WordPress · Payment Button For Paypal

Published 2026-01-17 · Updated 2026-01-17 · CVE-2025-14463

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions The Payment Button for PayPal plugin for WordPress versions prior to 1.2.3.41

Description The plugin exposes a public AJAX endpoint, wppaypalcheckout ajax process order, that processes checkout results without authentication or server-side verification of the PayPal transaction. This allows unauthenticated attackers to create arbitrary orders via direct POST requests to the endpoint, bypassing parameter validation. The plugin will also send purchase receipt emails to any supplied email address if email sending is enabled, potentially leading to order database corruption and unauthorized outgoing emails without a legitimate PayPal transaction.

Recommendations Update The Payment Button for PayPal plugin to a version later than 1.2.3.41.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-14463

Affected Products

Payment Button For Paypal

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-14463 · Security Note
• https://plugins.trac.wordpress.org/browser/wp-paypal/trunk/wp-paypal-checkout.php#L249 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/814e50de-3690-4adf-bc01-a63cd71bd1cf?source=cve · Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3431974%40wp-paypal&new=3431974%40wp-paypal&sfp_email=&sfph_mail= · Note
• https://twitter.com/CVEnew/status/2012490350498111625 · Twitter Post
• https://plugins.trac.wordpress.org/browser/wp-paypal/tags/1.2.3.41/wp-paypal-checkout.php#L249 · Note
• https://plugins.trac.wordpress.org/browser/wp-paypal/trunk/wp-paypal.php#L70 · Note
• https://plugins.trac.wordpress.org/browser/wp-paypal/tags/1.2.3.41/wp-paypal.php#L70 · Note