Missing authorization in WooCommerce PayPal Payments
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-862.
Summary
The WooCommerce PayPal Payments plugin for WordPress is vulnerable to unauthorized order manipulation and information disclosure due to missing authorization checks on the `ppc-create-order` and `ppc-get-order` WC-AJAX endpoints in all versions up to, and including, 4.0.1. The `ppc-create-order` endpoint accepts an arbitrary WooCommerce order ID in the `pay-now` context without validating order ownership, allowing attackers to create PayPal orders for any WC order and write PayPal metadata to it. The `ppc-get-order` endpoint returns full PayPal order details for any PayPal order ID without binding to the requester's session. This makes it possible for unauthenticated attackers to chain these endpoints to manipulate other customers' order payment flows and exfiltrate sensitive order details (payer information, shipping data) by creating a PayPal order for a victim's WC order and then retrieving the PayPal order data.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| WooCommerce | WooCommerce PayPal Payments | up to 4.0.1 | — | No fix listed | CNA |
- WooCommerce PayPal Payments VendorWooCommerce Affected up to 4.0.1 Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2026-9284
- 2026-10-03 Alias added: GHSA-x2h5-274p-6qqf
References
Other 6
- https://www.wordfence.com/threat-intel/vulnerabilities/id/d5fa3282-b3be-4ea1-9865-011dea828a25?source=cve
- https://plugins.trac.wordpress.org/browser/woocommerce-paypal-payments/tags/3.3.2/modules/ppcp-button/src/Endpoint/CreateOrderEndpoint.php#L249
- https://plugins.trac.wordpress.org/browser/woocommerce-paypal-payments/tags/3.3.2/modules/ppcp-button/src/Endpoint/GetOrderEndpoint.php#L44
- https://plugins.trac.wordpress.org/browser/woocommerce-paypal-payments/trunk/modules/ppcp-button/src/Endpoint/CreateOrderEndpoint.php#L249
- https://plugins.trac.wordpress.org/browser/woocommerce-paypal-payments/trunk/modules/ppcp-button/src/Endpoint/GetOrderEndpoint.php#L44
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3497597%40woocommerce-paypal-payments&new=3497597%40woocommerce-paypal-payments&sfp_email=&sfph_mail=
More WooCommerce vulnerabilities
- TI-2023-03274 WooCommerce Pre-Orders < 2.0.3 - Unauthorised Actions via CSRF CVSS 3.1MEDIUM 6.5
- TI-2023-03273 WooCommerce Pre-Orders < 2.0.3 - Arbitrary Pre-Order Canceling via CSRF CVSS 3.1MEDIUM 6.5
- TI-2023-02044 WooCommerce Order Status Change Notifier <= 1.1.0 - Subscriber+ Arbitrary Order Status Update CVSS 3.1MEDIUM 6.5
- TI-2022-00684 WooCommerce < 6.2.1 - Subscriber+ Arbitrary Comment Deletion CVSS 3.1MEDIUM 4.3
- TI-2021-06504 WooCommerce Help Scout < 2.9.1 - Unauthenticated Arbitrary File Upload leading to RCE CVSS 3.1CRITICAL 9.8
- TI-2023-17950 WordPress WooCommerce Product Vendors Plugin <= 2.1.78 is vulnerable to SQL Injection CVSS 3.1CRITICAL 9.8
Sources
- CVE-2026-9284 · CVE Program
- CVE-2026-9284 · NVD
- FIRST EPSS
- GHSA-x2h5-274p-6qqf · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences