CVE-2026-15211
Received Received - Intake

Unauthenticated PayPal Order Token Abuse in Subscriptions for WooCommerce

Publication date: 2026-08-07

Last updated on: 2026-08-07

Assigner: WPScan

Description
The Subscriptions for WooCommerce WordPress plugin before 2.0.1 does not validate the payment amount or bind the PayPal order token to the order being completed on the WooCommerce order-received flow: it captures a client-supplied token and marks the order paid whenever the capture status is COMPLETED, without comparing the captured amount to the order total. This allows an attacker (unauthenticated where guest checkout is enabled) to substitute an approved, uncaptured PayPal order token and have an expensive order marked paid without paying its price.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-07
Last Modified
2026-08-07
Generated
2026-08-07
AI Q&A
2026-08-07
EPSS Evaluated
N/A
NVD
CVE-2026-15211
EUVD
EUVD-2026-54400

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
woocommerce subscriptions to 2.0.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Subscriptions for WooCommerce plugin before version 2.0.1 has a flaw where it does not validate the payment amount or link the PayPal order token to the specific WooCommerce order during checkout. This allows an unauthenticated attacker to use an approved but uncaptured PayPal order token to mark an expensive order as paid without actually paying the required amount, provided guest checkout is enabled.

Detection Guidance

Check the installed version of the Subscriptions for WooCommerce plugin. If it is below 2.0.1, the system is vulnerable. Use commands like 'wp plugin list' in WordPress or inspect the plugin files for version details.

Impact Analysis

If you use the affected plugin version, an attacker could exploit this to get expensive orders marked as paid without paying, leading to financial losses. This is especially risky if guest checkout is enabled, as no authentication is required for the attack.

Mitigation Strategies

Update the Subscriptions for WooCommerce plugin to version 2.0.1 or later immediately. Disable guest checkout if not required to prevent unauthenticated exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-15211. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart