CVE-2026-17012

Name of the Vulnerable Software and Affected Versions Accept PayPal & Stripe with Subscriptions for WooCommerce WordPress plugin versions prior to 3.1.1

Description The plugin fails to verify if the PayPal account that received a payment matches the merchant's configured account before marking an order as paid. This allows unauthenticated buyers to complete a WooCommerce order by directing the full payment amount to their own PayPal account rather than the merchant's.

Recommendations Update the plugin to version 3.1.1 or later.