PayPal Pro Payment Gateway (< 4.1.1)

The WooCommerce PayPal Pro Payment Gateway plugin before version 4.1.1 is vulnerable to an unauthenticated payment bypass via the pp_capture_order AJAX handler, enabling attackers to mark unpaid orders as complete.