CVE-2026-17012

Deferred Deferred - Pending Action

PayPal Payment Verification Bypass in WooCommerce Subscriptions Plugin

Publication date: 2026-08-10

Last updated on: 2026-08-26

Assigner: WPScan

Description

The Accept PayPal & Stripe with Subscriptions for WooCommerce WordPress plugin through 3.1.0 does not verify that the PayPal account which received a payment matches the merchant's configured account before marking the order as paid, allowing unauthenticated buyers to complete a WooCommerce order by paying the full amount to their own PayPal account instead of the merchant's.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-10

Last Modified

2026-08-26

Generated

2026-08-30

AI Q&A

2026-08-10

EPSS Evaluated

2026-08-29

NVD

CVE-2026-17012

EUVD

EUVD-2026-55028

Affected Vendors & Products

Vendor	Product	Version / Range
woocommerce	accept_paypal_and_stripe_with_subscriptions	3.1.0
woocommerce	restore_paypal_standard	to 3.1.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This vulnerability affects the 'Restore PayPal Standard for WooCommerce' plugin versions 3.1.0 and below. It allows unauthenticated buyers to complete a WooCommerce order by paying the full amount to their own PayPal account instead of the merchant's account. The issue occurs because the plugin fails to verify that the PayPal account receiving the payment matches the merchant's configured account.

Detection Guidance

Check if the 'Restore PayPal Standard for WooCommerce' plugin version is 3.1.0 or below. Inspect WooCommerce order logs for payments marked as completed without proper PayPal account verification. Review PayPal transaction records to ensure payments match the merchant's configured account.

Impact Analysis

If you use this plugin, an attacker could exploit this vulnerability to pay for orders using their own PayPal account while the order is marked as paid in your WooCommerce store. This results in financial loss as you do not receive the payment for the order. It also undermines trust in your payment processing system.

Compliance Impact

This vulnerability could lead to non-compliance with financial and data protection regulations. For example, it may violate PCI DSS requirements for secure payment processing. It could also result in unauthorized transactions, which may conflict with GDPR principles of lawful and transparent data processing.

Mitigation Strategies

Update the 'Restore PayPal Standard for WooCommerce' plugin to the latest patched version immediately. Temporarily disable the plugin if an update is not available. Monitor WooCommerce orders for suspicious transactions where payments were made to unauthorized PayPal accounts.

Hi! I’m here to help you understand CVE-2026-17012. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70