Executive brief
The Restore PayPal Standard for WooCommerce plugin fails to verify that payments are received by the correct merchant PayPal account. An attacker can intercept the payment redirect and route a full purchase payment to their own PayPal account instead, while the order is still marked as paid by the merchant—resulting in free goods or services with no payment received.
Technical details
The plugin contains a broken access control vulnerability (CWE-284) in its PayPal Standard gateway integration. The vulnerability exists because the plugin does not validate the receiver_email field in PayPal Instant Payment Notifications (IPN) before marking orders as paid. An unauthenticated attacker can intercept the client-side checkout redirect form and modify the PayPal business parameter to their own email address, while leaving the order key and amount intact. When the attacker completes payment to their own PayPal account, the merchant's server receives a valid IPN notification from PayPal, but the plugin fails to properly enforce the receiver email mismatch—ultimately marking the order paid despite receiving no funds. The fix was released in version 4.0.0.
Affected products
- Restore Plugins Restore PayPal Standard for WooCommerce through 3.1.0
Timeline
- 2026-08-05: disclosed
- 2026-04-00: patched: Fixed in version 4.0.0