Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-92400

Payment Gateway for PayPal on WooCommerce · Vulnerability

CVSS 3.1 5.3 MEDIUMCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-92400

Published

The Payment Gateway for PayPal on WooCommerce WordPress plugin before 9.2.1 does not verify that an incoming payment notification was confirmed in the store's configured payment environment or paid to the store's own merchant account before marking an order complete, allowing unauthenticated users to mark their own orders as paid using a genuine transaction from a payment sandbox they control.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-92400

Published

Payment Gateway for PayPal on WooCommerce

https://wordpress.org/plugins

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Unknown",
                    "product": "Payment Gateway for PayPal on WooCommerce",
                    "versions": [
                        {
                            "status": "affected",
                            "versionType": "semver",
                            "version": "0",
                            "lessThan": "9.2.1"
                        }
                    ],
                    "defaultStatus": "unaffected",
                    "collectionURL": "https://wordpress.org/plugins"
                }

Original source record · Cite this exact observation · Complete original publisher JSON