WooCommerce PayPal Pro Payment Gateway: Unauthenticated payment bypass (CVE-2026-127204)
The WooCommerce PayPal Pro Payment Gateway plugin before version 4.1.1 is vulnerable to an unauthenticated payment bypass via the pp_capture_order AJAX handler, enabling attackers to mark unpaid orders as complete.
CVE search metadata
CVE search record: CVE-2026-127204. Severity: high. CVSS: 7.5. KEV: no. Product: PayPal Pro Payment Gateway (< 4.1.1). Brief: WooCommerce PayPal Pro Payment Gateway: Unauthenticated payment bypass (CVE-2026-127204). Brief link: https://feed.craftedsignal.io/briefs/2026-11-woocommerce-paypal-bypass-cve-2026-127204/
Triage facts
Revision 1- Applicability
- PayPal Pro Payment Gateway (< 4.1.1)
- Evidence
- Unknown
- Severity
- Medium
- Action
- Immediate escalation
- Sources
- 1 public source
- Freshness
- Revision 1Nov 12, 18:45 UTC
- Detection
- 1 rule
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
The WooCommerce PayPal Pro Payment Gateway plugin prior to version 4.1.1 contains an unauthenticated payment bypass vulnerability (CVE-2026-127204). The vulnerability exists within the pp_capture_order AJAX handler, which relies on a public checkout nonce and fails to correctly validate the payment status or amount returned by PayPal. An attacker can exploit this flaw to force an order status change to paid without fulfilling payment requirements.
Impact
Successful exploitation results in the automated fulfillment of goods or services for unpaid orders, causing direct financial loss to the merchant. The vulnerability allows for unauthenticated interaction with the payment confirmation logic.
Recommendation
Upgrade the WooCommerce PayPal Pro Payment Gateway plugin to version 4.1.1 or later immediately. Prior to patching, audit web server logs for suspicious access patterns to the site's AJAX endpoints.
Immediate actions
Update WooCommerce PayPal Pro Payment Gateway to version 4.1.1 or later.
Threat Hunt
Investigate web server access logs for anomalous volume of calls to the pp_capture_order AJAX action from non-standard user agents or IP addresses.
Data: web server logs
Mitigations
Apply patch version 4.1.1 for the WooCommerce PayPal Pro Payment Gateway.
CVE-2026-127204
Detection coverage 1
Detect CVE-2026-127204 Exploitation - Unauthorized pp_capture_order AJAX Request
highDetects potential exploitation attempts of CVE-2026-127204 by monitoring HTTP requests to the pp_capture_order AJAX handler, which is used to bypass payment validation.
Detection queries are available on the platform. Get full rules →