Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.3
CVE-2026-92400: WooCommerce PayPal gateway lets fake sandbox payment mark orders paid
CVE-2026-92400 · published 1 month ago
Summary
The PayPal payment plugin for WooCommerce versions before 9.2.1 does not check that a payment notification comes from the store's live environment or its own account. Because of this, anyone can use a test (sandbox) transaction they control to make an order appear fully paid. Update the plugin to version 9.2.1 or later to restore proper verification.
What to do
- Update unknown payment gateway for paypal on woocommerce to version 9.2.1 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| unknown | payment gateway for paypal on woocommerce | < 9.2.1 |
Original advisory text
Payment Gateway for PayPal on WooCommerce < 9.2.1 - Unauthenticated Payment Bypass via Sandbox IPN Environment Confusion
The Payment Gateway for PayPal on WooCommerce WordPress plugin before 9.2.1 does not verify that an incoming payment notification was confirmed in the store's configured payment environment or paid to the store's own merchant account before marking an order complete, allowing unauthenticated users to mark their own orders as paid using a genuine transaction from a payment sandbox they control.
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Type
CWE-345Insufficient Verification of Data Authenticity
Timeline
Published21 Sep 2026
Updated26 Oct 2026
First seen21 Sep 2026
Track software like this
Free during beta