Sylius PayPal Plugin Payment Amount Manipulation Vulnerability
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.
Summary
The Syliud PayPal Plugin is the Sylius Core Team’s plugin for the PayPal Commerce Platform. A vulnerability in versions prior to 1.6.1, 1.7.1, and 2.0.1 allows users to manipulate the final payment amount processed by PayPal. If a user modifies the item quantity in their shopping cart after initiating the PayPal Express Checkout process, PayPal will not receive the updated total amount. As a result, PayPal captures only the initially transmitted amount, while Sylius incorrectly considers the order fully paid based on the modified total. This flaw can be exploited both accidentally and intentionally, potentially enabling fraud by allowing customers to pay less than the actual order value. Attackers can intentionally pay less than the actual total order amount, business owners may suffer financial losses due to underpaid orders, and integrity of payment processing is compromised. The issue is fixed in versions 1.6.1, 1.7.1, 2.0.1, and above. To resolve the problem in the end application without updating to the newest patches, there is a need to overwrite `ProcessPayPalOrderAction`, `CompletePayPalOrderFromPaymentPageAction`, and `CaptureAction` with modified logic.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Sylius | PayPalPlugin | before 1.6.1; 1.7 to before 1.7.1; 2.0 to before 2.0.1 | 1.6.1, 1.7.1, 2.0.1 | Patch available | CNA |
| — | sylius/paypal-plugin (Packagist) | before 1.6.1 | 1.6.1 | Patch available | GHSA-pqq3-q84h-pj6x |
| — | sylius/paypal-plugin (Packagist) | 1.7.0 to before 1.7.1 | 1.7.1 | Patch available | GHSA-pqq3-q84h-pj6x |
| — | sylius/paypal-plugin (Packagist) | 2.0.0 to before 2.0.1 | 2.0.1 | Patch available | GHSA-pqq3-q84h-pj6x |
- PayPalPlugin VendorSylius Affected before 1.6.1; 1.7 to before 1.7.1; 2.0 to before 2.0.1 Fixed in 1.6.1, 1.7.1, 2.0.1 Patch available CNA
- sylius/paypal-plugin (Packagist) Vendor— Affected before 1.6.1 Fixed in 1.6.1 Patch available GHSA-pqq3-q84h-pj6x
- sylius/paypal-plugin (Packagist) Vendor— Affected 1.7.0 to before 1.7.1 Fixed in 1.7.1 Patch available GHSA-pqq3-q84h-pj6x
- sylius/paypal-plugin (Packagist) Vendor— Affected 2.0.0 to before 2.0.1 Fixed in 2.0.1 Patch available GHSA-pqq3-q84h-pj6x
Remediation
- Fix · CNA PayPalPlugin (Sylius) Fixed in 1.6.1, 1.7.1, 2.0.1
- Fix · GHSA-pqq3-q84h-pj6x sylius/paypal-plugin (Packagist) Fixed in 1.6.1 Advisory →
- Fix · GHSA-pqq3-q84h-pj6x sylius/paypal-plugin (Packagist) Fixed in 1.7.1 Advisory →
- Fix · GHSA-pqq3-q84h-pj6x sylius/paypal-plugin (Packagist) Fixed in 2.0.1 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2025-29788
- 2026-10-03 Alias added: GHSA-pqq3-q84h-pj6x
References
Other 7
- https://github.com/Sylius/PayPalPlugin/security/advisories/GHSA-pqq3-q84h-pj6x
- https://github.com/Sylius/PayPalPlugin/commit/31e71b0457e5d887a6c19f8cfabb8b16125ec406
- https://github.com/Sylius/PayPalPlugin/commit/8a81258f965b7860d4bccb52942e4c5b53e6774d
- https://github.com/Sylius/PayPalPlugin/releases/tag/v1.6.1
- https://github.com/Sylius/PayPalPlugin/releases/tag/v1.7.1
- https://github.com/Sylius/PayPalPlugin/releases/tag/v2.0.1
- https://github.com/Sylius/PayPalPlugin
More Sylius vulnerabilities
- TI-2026-65010 Sylius 2.x before 2.1.16 and 2.2.9 Payment Amount Overwrite CVSS 4.0HIGH 8.7
- TI-2026-24374 Sylius is Missing Authorization in API v2 Add Item Endpoint CVSS 4.0MEDIUM 6.9
- TI-2022-08557 Insufficient Session Expiration in Sylius CVSS 3.1HIGH 8.2
- TI-2026-48275 Sylius Mollie Plugin: Unauthenticated IDOR leaks order token and customer PII CVSS 3.1MEDIUM 6.5
- TI-2026-24378 Sylius has a DQL Injection via API Order Filters CVSS 3.1MEDIUM 5.3
- TI-2024-19437 Sylius 1.12.13 is vulnerable to Cross Site Scripting (XSS) via the "Province" field in Address Book. CVSS 3.1MEDIUM 6.4
Sources
- CVE-2025-29788 · CVE Program
- CVE-2025-29788 · NVD
- FIRST EPSS
- GHSA-pqq3-q84h-pj6x · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences