Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.2

WooCommerce PayPal Payments plugin for WordPress allows unauthorized order changes

CVE-2026-9284 · published 5 months ago
Summary

The WooCommerce PayPal Payments plugin for WordPress has a security issue that allows attackers to manipulate other customers' orders and steal sensitive information. This affects all versions up to 4.0.1. To protect your customers, update the plugin to the latest version as soon as possible.

Original advisory text
The WooCommerce PayPal Payments plugin for WordPress is vulnerable to unauthorized order manipulation and information disclosure due to missing authorization checks on the `ppc-create-order` and `p...
The WooCommerce PayPal Payments plugin for WordPress is vulnerable to unauthorized order manipulation and information disclosure due to missing authorization checks on the `ppc-create-order` and `ppc-get-order` WC-AJAX endpoints in all versions up to, and including, 4.0.1. The `ppc-create-order` endpoint accepts an arbitrary WooCommerce order ID in the `pay-now` context without validating order ownership, allowing attackers to create PayPal orders for any WC order and write PayPal metadata to it. The `ppc-get-order` endpoint returns full PayPal order details for any PayPal order ID without binding to the requester's session. This makes it possible for unauthenticated attackers to chain these endpoints to manipulate other customers' order payment flows and exfiltrate sensitive order details (payer information, shipping data) by creating a PayPal order for a victim's WC order and then retrieving the PayPal order data.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
8.2 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-862Missing Authorization
Timeline
Published23 May 2026
Updated4 Nov 2026
First seen26 May 2026
Sources
CVE-2026-9284 · NVD
Track software like this
Free during beta