Security Alert Summary
The Payment Gateway for PayPal on WooCommerce WordPress plugin before 9.2.1 does not verify that an incoming payment notification was confirmed in the store’s configured payment environment or paid to the store’s own merchant account before marking an order complete. This allows an unauthenticated actor to mark their own orders as paid using a genuine transaction from a payment sandbox they control.
CVE Details
- CVE ID: CVE-2026-92400
- Affected plugin/component: Payment Gateway for PayPal on WooCommerce
- Affected versions: versions before 9.2.1 (less than 9.2.1)
- Published: September 21, 2026 at 9:17:06 AM UTC
- Last modified: September 21, 2026 at 3:17:35 PM UTC
- CVSS v3.1 base score: 5.3 — MEDIUM
- CVSS v3.1 vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Authentication / privileges / user interaction: No authentication required; privileges required: none; no user interaction
- Primary impact (CIA): Confidentiality: None; Integrity: Low; Availability: None
- CWE / weakness: CWE-345 (Insufficient Verification of Data Authenticity)
Technical Details
The plugin fails to verify that an incoming payment notification corresponds to a transaction that was confirmed in the store’s configured payment environment or that the payment was made to the store’s merchant account before it marks the related order as complete. As described in the vulnerability report, an attacker who controls a payment sandbox can submit a genuine sandbox transaction and cause the plugin to treat that transaction as a valid payment for an order on the affected store.
This behavior exists because the plugin does not perform the necessary checks on incoming payment notifications to ensure they originate from the store’s configured (production) payment environment and are addressed to the store’s merchant account. The result is an integrity impact: orders can be marked as paid without a validated payment in the store’s actual payment environment.
How This Could Impact Your Website
Consider a small e-commerce site where the site owner manages products, an internal staff member handles orders, and external contributors or contractors place test orders. An attacker who can create and control a sandbox payment account could place an order and submit a sandbox-originating payment notification. Because the plugin does not verify that the notification was from the store’s configured payment environment or paid to the store’s merchant account, the order may be marked complete even though no legitimate production payment was received.
Practical consequences include incorrect order status leading to fulfillment of unpaid orders, reconciliation discrepancies for accounting, and increased administrative overhead to investigate and remediate affected orders. There is also an increased risk of targeted social engineering or phishing attempts if attackers leverage order communications as part of a broader campaign, although the CVSS data indicates no direct confidentiality impact from this vulnerability.
If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor-level access and other roles that can place orders.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins to reduce the attack surface.
- Monitor site activity and order logs for unusual behavior, including unexpected order completions and payment notification sources.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
