CVE-2026-17012
N/A
N/A
Summary
The Accept PayPal & Stripe with Subscriptions for WooCommerce WordPress plugin through 3.1.0 does not verify that the PayPal account which received a payment matches the merchant's configured account before marking the order as paid, allowing unauthenticated buyers to complete a WooCommerce order by paying the full amount to their own PayPal account instead of the merchant's.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Unknown | Accept PayPal & Stripe with Subscriptions for WooCommerce | 0 <= 3.1.0 | affected |
Weaknesses
- CWE-284 Improper Access Control
References
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.