Executive brief
The Restore PayPal Standard for WooCommerce plugin is used by online retailers to accept PayPal payments. A vulnerability in its PayPal Data Transfer return handler allows customers to pay a reduced amount (or no amount) and still have their order marked as fully paid. An attacker can tamper with payment amounts before checkout completes, enabling them to purchase products for nearly free, directly harming store revenue.
Technical details
This is a payment amount validation bypass (CWE-284: Improper Access Control) in the PayPal Data Transfer (PDT) return handler. The vulnerable component fails to compare the amount actually paid by the customer against the order total. An unauthenticated attacker with network access can intercept the client-side redirect form to PayPal, modify the amount field before submission, complete payment for the reduced sum, and the order is marked fully paid without validation. An attacker achieves arbitrary underpayment or non-payment for goods. The vulnerability was patched in version 3.1.1.
Affected products
- WPPlugins Restore PayPal Standard for WooCommerce through 3.1.0
Timeline
- 2026-08-05: disclosed
- 2026-08-10: patched: Fixed in version 3.1.1