{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3awoocommercepaypal_pro_payment_gateway/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:woocommerce:paypal_pro_payment_gateway:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-127204"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["PayPal Pro Payment Gateway (\u003c 4.1.1)"],"_cs_severities":["medium"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["WooCommerce"],"content_html":"\u003cp\u003eThe WooCommerce PayPal Pro Payment Gateway plugin prior to version 4.1.1 contains an unauthenticated payment bypass vulnerability (CVE-2026-127204). The vulnerability exists within the pp_capture_order AJAX handler, which relies on a public checkout nonce and fails to correctly validate the payment status or amount returned by PayPal. An attacker can exploit this flaw to force an order status change to paid without fulfilling payment requirements.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in the automated fulfillment of goods or services for unpaid orders, causing direct financial loss to the merchant. The vulnerability allows for unauthenticated interaction with the payment confirmation logic.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003eUpgrade the WooCommerce PayPal Pro Payment Gateway plugin to version 4.1.1 or later immediately. Prior to patching, audit web server logs for suspicious access patterns to the site's AJAX endpoints.\u003c/p\u003e\n","date_modified":"2026-11-12T18:45:48Z","date_published":"2026-11-12T18:45:48Z","id":"https://feed.craftedsignal.io/briefs/2026-11-woocommerce-paypal-bypass-cve-2026-127204/","summary":"The WooCommerce PayPal Pro Payment Gateway plugin before version 4.1.1 is vulnerable to an unauthenticated payment bypass via the pp_capture_order AJAX handler, enabling attackers to mark unpaid orders as complete.","title":"WooCommerce PayPal Pro Payment Gateway: Unauthenticated payment bypass (CVE-2026-127204)","url":"https://feed.craftedsignal.io/briefs/2026-11-woocommerce-paypal-bypass-cve-2026-127204/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:woocommerce:paypal_pro_payment_gateway:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}