PT-2026-42867 · Woocommerce · Woocommerce Paypal Payments
Dmitry Ignatyev
·
Published
2026-05-23
·
Updated
2026-05-23
·
CVE-2026-9284
CVSS v3.1
8.2
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
WooCommerce PayPal Payments versions prior to 4.0.2
Description
Missing authorization checks on the 'ppc-create-order' and 'ppc-get-order' WC-AJAX endpoints allow unauthorized order manipulation and information disclosure. The 'ppc-create-order' endpoint accepts an arbitrary WooCommerce order ID via the
pay-now context without validating order ownership, enabling attackers to create PayPal orders for any WooCommerce order and write PayPal metadata to it. Additionally, the 'ppc-get-order' endpoint returns full PayPal order details for any PayPal order ID without binding to the requester's session. Unauthenticated attackers can chain these endpoints to manipulate payment flows of other customers and exfiltrate sensitive data, including payer information and shipping data.Recommendations
Update to a version later than 4.0.1.
As a temporary workaround, restrict access to the 'ppc-create-order' and 'ppc-get-order' endpoints to minimize the risk of exploitation.
Fix
Missing Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Woocommerce Paypal Payments