CVE-2026-113468

Name of the Vulnerable Software and Affected Versions The product name cannot be determined (affected versions not specified)

Description The payment notification endpoint for PayPal accepts incoming data without verifying the source, allowing any site visitor to overwrite the stored payment notification of an order awaiting payment with arbitrary content. This issue requires a page containing the shop's order plugin to be present. Orders that have already been paid are not affected.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.