CVE-2026-16621

Name of the Vulnerable Software and Affected Versions Payment Gateway for PayPal on WooCommerce WordPress plugin versions prior to 9.2.1

Description The plugin fails to verify if a payment was successful before completing an order within its PayPal return handler. An unauthenticated attacker can mark arbitrary orders as paid without completing the actual payment because the system reads attacker-controlled parameters, performs no amount comparison, and lacks order-ownership checks. The order is completed even if the server-side gateway verification fails.

Recommendations Update the plugin to version 9.2.1 or later.