Executive brief
The Payment Plugins for PayPal WooCommerce WordPress plugin before version 2.0.27 fails to verify that a PayPal payment order belongs to the correct WooCommerce transaction. An unauthenticated attacker can intercept an approved but uncaptured payment from another buyer and capture it against their own order, resulting in unauthorized payment redirection and financial loss.
Technical details
This is an insecure direct object reference (IDOR) vulnerability in the payment processing logic. The plugin does not validate that a PayPal order ID supplied in a payment request matches the WooCommerce order being paid, unless the PayPal order has already been completed. An unauthenticated attacker can exploit this to hijack approved-but-uncaptured payments by submitting another customer's PayPal order ID with their own order, causing the payment to be captured against the attacker's order. The vulnerability has been fixed in version 2.0.27.
Affected products
- paymentplugins Payment Plugins for PayPal WooCommerce before 2.0.27
Timeline
- 2026-09-21: disclosed
- 2026-09-23: patched: Fixed in version 2.0.27