PT-2026-69357 · WordPress · Accept Paypal & Stripe With Subscriptions
CVE-2026-17012
·
Published
2026-08-10
·
Updated
2026-08-10
CVSS v3.1
5.3
Medium
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Accept PayPal & Stripe with Subscriptions for WooCommerce WordPress plugin versions prior to 3.1.1
Description
The plugin fails to verify if the PayPal account that received a payment matches the merchant's configured account before marking an order as paid. This allows unauthenticated buyers to complete a WooCommerce order by directing the full payment amount to their own PayPal account rather than the merchant's.
Recommendations
Update the plugin to version 3.1.1 or later.
Exploit
Fix
Improper Access Control
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Accept Paypal & Stripe With Subscriptions