CVE-2026-17008: Quick PayPal Payments <= 5.7.50 - Unauthenticated Payment Bypass via PayPal IPN
The Quick Paypal Payments WordPress plugin through 5.7.50 does not verify the paid amount, receiver, or payment status in its PayPal IPN handler and marks an order paid on an order-token match alone, so a buyer who pays an arbitrary small amount can have a full-price order marked paid.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-17008?
The severity of CVE-2026-17008 is classified as medium with a score of 5.3.
How do I fix CVE-2026-17008?
To fix CVE-2026-17008, update the Quick PayPal Payments plugin to version 5.7.51 or later.
What is the risk associated with CVE-2026-17008?
The risk associated with CVE-2026-17008 is rated at 27, indicative of potential financial loss due to payment bypass.
What type of vulnerability is CVE-2026-17008?
CVE-2026-17008 is an unauthenticated payment bypass vulnerability affecting the Quick PayPal Payments plugin.
Who is affected by CVE-2026-17008?
Users of the Quick PayPal Payments WordPress plugin through version 5.7.50 are affected by CVE-2026-17008.