CyberRota Analysis
AI-GeneratedThe Payment Gateway for PayPal on WooCommerce WordPress plugin prior to version 9.2.1 is vulnerable due to inadequate verification of payment success, allowing attackers to manipulate order statuses without proper authentication. This flaw can lead to unauthorized completion of orders, potentially resulting in financial losses for merchants. WordPress site administrators using this plugin should prioritize updating to the latest version to mitigate this risk.
Original NVD Description
The Payment Gateway for PayPal on WooCommerce WordPress plugin before 9.2.1 does not verify that payment actually succeeded before completing an order in its PayPal return handler: it reads attacker-controlled parameters, performs no amount comparison and no order-ownership check, and completes the order even when the server-side gateway verification fails, allowing an unauthenticated attacker to mark arbitrary orders as paid without paying.