CVE-2026-92400
Received Received - Intake

Payment Gateway for PayPal on WooCommerce Authentication Bypass

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: WPScan

Description
The Payment Gateway for PayPal on WooCommerce WordPress plugin before 9.2.1 does not verify that an incoming payment notification was confirmed in the store's configured payment environment or paid to the store's own merchant account before marking an order complete, allowing unauthenticated users to mark their own orders as paid using a genuine transaction from a payment sandbox they control.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-21
Last Modified
2026-09-21
Generated
2026-09-21
AI Q&A
2026-09-21
EPSS Evaluated
N/A
NVD
CVE-2026-92400
EUVD
EUVD-2026-83870

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
woocommerce payment_gateway_for_paypal to 9.2.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the Payment Gateway for PayPal on WooCommerce plugin before version 9.2.1. It allows unauthenticated users to mark their orders as paid without actually completing a valid payment. The plugin fails to verify if a payment notification came from the store's configured environment or was paid to the store's merchant account before updating order status.

Detection Guidance

Check the installed version of the 'Payment Gateway for PayPal on WooCommerce' plugin. If it is below 9.2.1, the system is vulnerable. Use WordPress admin panel or run: wp plugin list --name='woocommerce-gateway-paypal' in WP-CLI to verify the version.

Impact Analysis

Attackers could exploit this to get free products or services by marking their orders as paid without making a real payment. This could lead to financial losses for the store owner and disrupt legitimate transactions.

Compliance Impact

This vulnerability could lead to unauthorized transactions being marked as paid, potentially violating financial record-keeping requirements under standards like GDPR (data integrity) and HIPAA (audit controls). Unverified payments may result in incorrect financial reporting, undermining compliance with financial and data protection regulations.

Mitigation Strategies

Update the 'Payment Gateway for PayPal on WooCommerce' plugin to version 9.2.1 or later immediately. Disable the plugin temporarily if an update is not immediately available. Review recent orders marked as paid to ensure they were legitimate transactions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-92400. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart