Unauthenticated Payment Bypass in WooCommerce PayPal Pro Payment Gateway

Executive Summary

This vulnerability is an unauthenticated payment bypass in the WooCommerce PayPal Pro Payment Gateway plugin before version 4.1.1. Attackers can exploit the pp_capture_order AJAX handler, which only checks a public nonce, to mark unpaid orders as paid without verifying the actual PayPal capture status or amount. This allows them to trigger payment completion and fulfill orders without receiving payment, causing direct financial loss to merchants.

Useful 0 Not Useful 0

Detection Guidance

Check if the WooCommerce PayPal Pro Payment Gateway plugin version is below 4.1.1. Inspect server logs for unusual AJAX requests to pp_capture_order with _paypal_order_id parameters. Look for orders marked as paid without corresponding PayPal transactions.

Useful 0 Not Useful 0

Impact Analysis

If you are a merchant using the vulnerable plugin, attackers can exploit this to make your store fulfill orders without receiving payment. This results in direct financial loss as you provide goods or services without compensation. The vulnerability affects PayPal Pro, PayPal Checkout, and Subscriptions for WooCommerce versions prior to 4.1.1.

Useful 0 Not Useful 0

Mitigation Strategies

Update the plugin to version 4.1.1 or later immediately. Disable the pp_capture_order AJAX handler if not required. Review recent orders for unauthorized payment completions and refund affected transactions.

Useful 0 Not Useful 0