CVE-2026-15211

Deferred Deferred - Pending Action

Unauthenticated PayPal Order Token Abuse in Subscriptions for WooCommerce

Publication date: 2026-08-07

Last updated on: 2026-08-26

Assigner: WPScan

Description

The Subscriptions for WooCommerce WordPress plugin before 2.0.1 does not validate the payment amount or bind the PayPal order token to the order being completed on the WooCommerce order-received flow: it captures a client-supplied token and marks the order paid whenever the capture status is COMPLETED, without comparing the captured amount to the order total. This allows an attacker (unauthenticated where guest checkout is enabled) to substitute an approved, uncaptured PayPal order token and have an expensive order marked paid without paying its price.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-07

Last Modified

2026-08-26

Generated

2026-08-27

AI Q&A

2026-08-07

EPSS Evaluated

2026-08-26

NVD

CVE-2026-15211

EUVD

EUVD-2026-54400

Affected Vendors & Products

Vendor	Product	Version / Range
woocommerce	subscriptions	to 2.0.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-345	The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

Attack-Flow Graph

Executive Summary

The Subscriptions for WooCommerce plugin before version 2.0.1 has a flaw where it does not validate the payment amount or link the PayPal order token to the specific WooCommerce order during checkout. This allows an unauthenticated attacker to use an approved but uncaptured PayPal order token to mark an expensive order as paid without actually paying the required amount, provided guest checkout is enabled.

Detection Guidance

Check the installed version of the Subscriptions for WooCommerce plugin. If it is below 2.0.1, the system is vulnerable. Use commands like 'wp plugin list' in WordPress or inspect the plugin files for version details.

Impact Analysis

If you use the affected plugin version, an attacker could exploit this to get expensive orders marked as paid without paying, leading to financial losses. This is especially risky if guest checkout is enabled, as no authentication is required for the attack.

Compliance Impact

This vulnerability could lead to unauthorized transactions, potentially violating financial compliance requirements under standards like PCI DSS. It may also result in improper handling of payment data, which could conflict with GDPR principles of lawful processing and data integrity if personal or payment information is mishandled.

Mitigation Strategies

Update the Subscriptions for WooCommerce plugin to version 2.0.1 or later immediately. Disable guest checkout if not required to prevent unauthenticated exploitation.

Hi! I’m here to help you understand CVE-2026-15211. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70