CVE-2026-127204: WooCommerce PayPal Pro Payment Gateway < 4.1.1 Payment Bypass via pp_capture_order
WooCommerce PayPal Pro Payment Gateway plugin before 4.1.1 contains an unauthenticated payment bypass vulnerability that allows remote attackers to mark unpaid orders as paid by exploiting the ppcaptureorder AJAX handler, which is gated only by a public checkout nonce and fails to properly validate the PayPal capture response status. Attackers can supply a valid paypalorderid to trigger paymentcomplete() without verifying the capture status or amount, causing the store to fulfill goods or services that were never paid for and resulting in direct financial loss to the merchant.
Event History
Frequently Asked Questions
Which deployments are exposed?
Stores using WooCommerce PayPal Pro Payment Gateway versions before 4.1.1 are affected. The vulnerable pp_capture_order AJAX handler is reachable without authentication.
What does an attacker need to exploit this issue?
An attacker needs a valid public checkout nonce and a valid _paypal_order_id. No authenticated WordPress or WooCommerce account is required.
What is the practical impact of successful exploitation?
An attacker can cause an unpaid order to be marked paid through payment_complete() without validation of the PayPal capture status or amount. This can lead the store to fulfill goods or services without receiving payment.
How can I determine whether an order may have been affected?
Review orders marked paid through the PayPal Pro payment flow and compare their recorded payment status and amount with the corresponding PayPal capture results. The vulnerable handler can mark an order paid without a successful capture status or matching amount.