Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
3.7
CVE-2026-17016: WooCommerce PayPal Plugin Fails to Validate Payments
CVE-2026-17016 · published 2 months ago
Summary
The Accept PayPal & Stripe with Subscriptions for WooCommerce plugin does not check if customers pay the full amount when using PayPal. This could allow customers to pay less than the order total and still have the order marked as fully paid. To protect your business, update the plugin to the latest version.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| unknown | accept paypal & stripe with subscriptions for woocommerce | <= 3.1.0 |
Original advisory text
Restore PayPal Standard for WooCommerce <= 3.1.0 - Payment Bypass via PDT Underpayment
The Accept PayPal & Stripe with Subscriptions for WooCommerce WordPress plugin through 3.1.0 does not validate the amount actually paid against the order total in its PayPal Data Transfer return handler, allowing a customer to pay less than the order total and still have the order marked as fully paid when the PayPal Data Transfer feature is enabled.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
3.7
Low
Type
CWE-284Improper Access Control
Timeline
Published10 Aug 2026
Updated4 Nov 2026
First seen10 Aug 2026
Track software like this
Free during beta