CVE-2026-9284
The WooCommerce PayPal Payments plugin for WordPress is vulnerable to unauthorized order manipulation and information disclosure due to missing authorization checks on…
Published May 23, 2026 · updated Jul 23, 2026
The WooCommerce PayPal Payments plugin for WordPress is vulnerable to unauthorized order manipulation and information disclosure due to missing authorization checks on the and WC-AJAX endpoints in all versions up to, and including, 4.0.1. The endpoint accepts an arbitrary WooCommerce order ID in the context without validating order ownership, allowing attackers to create PayPal orders for any WC order and write PayPal metadata to it. The endpoint returns full PayPal order details for any PayPal order ID without binding to the requester's session. This makes it possible for unauthenticated attackers to chain these endpoints to manipulate other customers' order payment flows and exfiltrate sensitive order details (payer information, shipping data) by creating a PayPal order for a victim's WC order and then retrieving the PayPal order data.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
May 23, 2026 · NIST NVD
Detected
The WooCommerce PayPal Payments plugin for WordPress is vulnerable to unauthorized order manipulation and information disclosure due to missing authorization checks on the and WC-AJAX endpoints in all versions up to, and including, 4.0.1. The endpoint accepts an arbitrary WooCommerce order ID in the context without validating order ownership, allowing attackers to create PayPal orders for any WC o
Jul 23, 2026 · NIST NVD
Updated
The WooCommerce PayPal Payments plugin for WordPress is vulnerable to unauthorized order manipulation and information disclosure due to missing authorization checks on the and WC-AJAX endpoints in all versions up to, and including, 4.0.1. The endpoint accepts an arbitrary WooCommerce order ID in the context without validating order ownership, allowing attackers to create PayPal orders for any WC o
Sources
- CVE.orgVulnerability recordCVE-2026-9284
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-9284
The WooCommerce PayPal Payments plugin for WordPress is vulnerable to unauthorized order manipulation and information disclosure due to missing authorization checks on the and WC-AJAX endpoints in all versions up to, and including, 4.0.1. The `p
nvd.nist.gov