CVE-2026-15211

Name of the Vulnerable Software and Affected Versions Subscriptions for WooCommerce versions prior to 2.0.1

Description An issue exists in the WooCommerce order-received flow where the plugin fails to validate the payment amount or bind the PayPal order token to the order being completed. The system captures a client-supplied token and marks the order as paid whenever the capture status is COMPLETED, without verifying if the captured amount matches the order total. This allows an unauthenticated attacker, when guest checkout is enabled, to use an approved but uncaptured PayPal order token to mark an expensive order as paid without paying the actual price.

Recommendations Update Subscriptions for WooCommerce to version 2.0.1 or later.