PayPal Pro Payment Gateway (< 4.1.1) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/paypal-pro-payment-gateway--4.1.1/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 12 Nov 2026 18:45:48 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgWooCommerce PayPal Pro Payment Gateway: Unauthenticated payment bypass (CVE-2026-127204)https://feed.craftedsignal.io/briefs/2026-11-woocommerce-paypal-bypass-cve-2026-127204/Thu, 12 Nov 2026 18:45:48 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-woocommerce-paypal-bypass-cve-2026-127204/The WooCommerce PayPal Pro Payment Gateway plugin before version 4.1.1 is vulnerable to an unauthenticated payment bypass via the pp_capture_order AJAX handler, enabling attackers to mark unpaid orders as complete.The WooCommerce PayPal Pro Payment Gateway plugin prior to version 4.1.1 contains an unauthenticated payment bypass vulnerability (CVE-2026-127204). The vulnerability exists within the pp_capture_order AJAX handler, which relies on a public checkout nonce and fails to correctly validate the payment status or amount returned by PayPal. An attacker can exploit this flaw to force an order status change to paid without fulfilling payment requirements.

Impact

Successful exploitation results in the automated fulfillment of goods or services for unpaid orders, causing direct financial loss to the merchant. The vulnerability allows for unauthenticated interaction with the payment confirmation logic.

Recommendation

Upgrade the WooCommerce PayPal Pro Payment Gateway plugin to version 4.1.1 or later immediately. Prior to patching, audit web server logs for suspicious access patterns to the site's AJAX endpoints.

]]>mediumadvisory