ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2025-14463

The Payment Button for PayPal plugin for WordPress is vulnerable to unauthorized order creation in all versions up to, and including, 1.2.3.41.

Published Jan 17, 2026 · catalog updated Apr 8, 2026 · Payment Button for PayPal

Last checked Nov 6, 2026. A connected source was read within the last 7 days.

Check if you run it

No confirmed exploitation is on record for CVE-2025-14463. EPSS is 0.35%. Act only if a listed version of Payment Button for PayPal is installed.

Gaps on this record

  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
Medium5.3
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.35%
Remediation
Vendor / distro source
Affected products
vendor naa986 Payment Button for PayPal 0 ≤1.2.3.41

The Payment Button for PayPal plugin for WordPress is vulnerable to unauthorized order creation in all versions up to, and including, 1.2.3.41. This is due to the plugin exposing a public AJAX endpoint ( ) that processes checkout results without any authentication or server-side verification of the PayPal transaction. This makes it possible for unauthenticated attackers to create arbitrary orders on the site with any chosen transaction ID, payment status, product name, amount, or customer information via direct POST requests to the AJAX endpoint, granted they can bypass basic parameter validat

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • vendor naa986 Payment Button for PayPal 0 ≤1.2.3.410 ≤1.2.3.41

How to fix CVE-2025-14463

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2025-14463. EPSS is 0.35%. Act only if a listed version of Payment Button for PayPal is installed.

Which versions are affected?

Compare what you have installed with naa986 Payment Button for PayPal 0 ≤1.2.3.41 0 ≤1.2.3.41. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

No weakness class is stored. EPSS 0.35%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Technology hubs

WordPress security

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Jan 17, 2026 · EUVD

    Detected

    The Payment Button for PayPal plugin for WordPress is vulnerable to unauthorized order creation in all versions up to, and including, 1.2.3.41. This is due to the plugin exposing a public AJAX endpoint ( ) that processes checkout results without any authentication or server-side verification of the PayPal transaction. This makes it possible for unauthenticated attackers to create arbitrary orders

  2. Apr 8, 2026 · EUVD

    Updated

    The Payment Button for PayPal plugin for WordPress is vulnerable to unauthorized order creation in all versions up to, and including, 1.2.3.41. This is due to the plugin exposing a public AJAX endpoint ( ) that processes checkout results without any authentication or server-side verification of the PayPal transaction. This makes it possible for unauthenticated attackers to create arbitrary orders

Sources

  • CVE.orgVulnerability recordCVE-2025-14463

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2025-14463

    30-day exploitation probability 0.35%

    first.org
  • EUVDVulnerability recordEUVD-2026-3152

    The Payment Button for PayPal plugin for WordPress is vulnerable to unauthorized order creation in all versions up to, and including, 1.2.3.41. This is due to the plugin exposing a public AJAX endpoint ( ) that processes checkout results without any authentication or server-side

    euvd.enisa.europa.eu

References

Freshness

Last verified in this catalog Nov 6, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

  • FIRST EPSSNov 6, 2026
  • CVE.orgNov 4, 2026
  • EUVDNov 2, 2026