Read the docs
TI-2025-21491 Aliases CVE-2025-30152GHSA-hxg4-65p5-9w37

Sylius PayPal Plugin has an Order Manipulation Vulnerability after PayPal Checkout

Priority LOW 29CWE-472Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

The Syliud PayPal Plugin is the Sylius Core Team’s plugin for the PayPal Commerce Platform. Prior to 1.6.2, 1.7.2, and 2.0.2, a discovered vulnerability allows users to modify their shopping cart after completing the PayPal Checkout process and payment authorization. If a user initiates a PayPal transaction from a product page or the cart page and then returns to the order summary page, they can still manipulate the cart contents before finalizing the order. As a result, the order amount in Sylius may be higher than the amount actually captured by PayPal, leading to a scenario where merchants deliver products or services without full payment. The issue is fixed in versions: 1.6.2, 1.7.2, 2.0.2 and above.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0035 28th percentileScored 2026-11-07
Fix Fixed PayPalPlugin (Sylius): 1.6.2, 1.7.2, 2.0.2sylius/paypal-plugin (Packagist): 1.6.2, 1.7.2, 2.0.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SyliusPayPalPluginbefore 1.6.2; 1.7.0 to before 1.7.2; 2.0.0 to before 2.0.21.6.2, 1.7.2, 2.0.2Patch availableCNA
—sylius/paypal-plugin (Packagist)before 1.6.21.6.2Patch availableGHSA-hxg4-65p5-9w37
—sylius/paypal-plugin (Packagist)1.7.0 to before 1.7.21.7.2Patch availableGHSA-hxg4-65p5-9w37
—sylius/paypal-plugin (Packagist)2.0.0 to before 2.0.22.0.2Patch availableGHSA-hxg4-65p5-9w37
  • PayPalPlugin VendorSylius Affected before 1.6.2; 1.7.0 to before 1.7.2; 2.0.0 to before 2.0.2 Fixed in 1.6.2, 1.7.2, 2.0.2 Patch available CNA
  • sylius/paypal-plugin (Packagist) Vendor— Affected before 1.6.2 Fixed in 1.6.2 Patch available GHSA-hxg4-65p5-9w37
  • sylius/paypal-plugin (Packagist) Vendor— Affected 1.7.0 to before 1.7.2 Fixed in 1.7.2 Patch available GHSA-hxg4-65p5-9w37
  • sylius/paypal-plugin (Packagist) Vendor— Affected 2.0.0 to before 2.0.2 Fixed in 2.0.2 Patch available GHSA-hxg4-65p5-9w37

Remediation

  • Fix · CNA PayPalPlugin (Sylius) Fixed in 1.6.2, 1.7.2, 2.0.2
  • Fix · GHSA-hxg4-65p5-9w37 sylius/paypal-plugin (Packagist) Fixed in 1.6.2 Advisory →
  • Fix · GHSA-hxg4-65p5-9w37 sylius/paypal-plugin (Packagist) Fixed in 1.7.2 Advisory →
  • Fix · GHSA-hxg4-65p5-9w37 sylius/paypal-plugin (Packagist) Fixed in 2.0.2 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-30152
  2. 2026-10-03 Alias added: GHSA-hxg4-65p5-9w37

References

Advisory 1

Other 3

  • TI-2026-65010 Sylius 2.x before 2.1.16 and 2.2.9 Payment Amount Overwrite CVSS 4.0HIGH 8.7
  • TI-2026-24374 Sylius is Missing Authorization in API v2 Add Item Endpoint CVSS 4.0MEDIUM 6.9
  • TI-2022-08557 Insufficient Session Expiration in Sylius CVSS 3.1HIGH 8.2
  • TI-2026-48275 Sylius Mollie Plugin: Unauthenticated IDOR leaks order token and customer PII CVSS 3.1MEDIUM 6.5
  • TI-2026-24378 Sylius has a DQL Injection via API Order Filters CVSS 3.1MEDIUM 5.3
  • TI-2024-19437 Sylius 1.12.13 is vulnerable to Cross Site Scripting (XSS) via the "Province" field in Address Book. CVSS 3.1MEDIUM 6.4
See all 37 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences