CVE-2026-92400

Name of the Vulnerable Software and Affected Versions Payment Gateway for PayPal on WooCommerce WordPress plugin versions prior to 9.2.1

Description An issue exists where the plugin fails to verify if an incoming payment notification was confirmed within the store's configured payment environment or paid to the store's own merchant account before marking an order as complete. This allows unauthenticated users to mark their own orders as paid by using a genuine transaction from a payment sandbox they control.

Recommendations Update the plugin to version 9.2.1 or later.