CVE-2025-30152: Sylius PayPal Plugin Auth Bypass Flaw

CVE-2025-30152 Overview

CVE-2025-30152 affects the Sylius PayPal Plugin, the Sylius Core Team's official integration for the PayPal Commerce Platform. The vulnerability allows users to modify their shopping cart after completing the PayPal Checkout process and payment authorization. When a user initiates a PayPal transaction from a product or cart page and returns to the order summary page, they can still manipulate cart contents before finalizing the order. The order amount in Sylius may then exceed the amount actually captured by PayPal, causing merchants to deliver products or services without full payment. The issue is a business logic flaw classified as [CWE-472] (External Control of Assumed-Immutable Web Parameter).

Critical Impact
Attackers can complete PayPal authorization for a low-value cart, add items before finalizing the order, and receive goods worth more than the captured payment amount.

Affected Products

Sylius PayPal Plugin versions prior to 1.6.2
Sylius PayPal Plugin 1.7.x versions prior to 1.7.2
Sylius PayPal Plugin 2.0.x versions prior to 2.0.2

Discovery Timeline

2025-03-19 - CVE-2025-30152 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-30152

Vulnerability Analysis

The vulnerability is a business logic flaw in the PayPal checkout completion workflow. The plugin authorizes a PayPal payment based on the cart total at the moment PayPal Checkout is initiated. Sylius then relies on the assumption that the cart is immutable between authorization and order finalization. That assumption breaks when the user navigates back to the order summary page, where the cart remains editable. An attacker adds items after authorization, and the order is finalized against a captured amount that no longer reflects the true order total.

Root Cause

The PayPalOrderCompleteProcessor class in src/Processor/PayPalOrderCompleteProcessor.php did not verify that the authorized PayPal payment amount matched the final Sylius order total. No PaymentAmountVerifierInterface component existed to reconcile the two values before completing the order. This missing server-side validation allowed the client-controlled cart state to override the assumed-immutable authorization amount.

Attack Vector

An authenticated buyer initiates PayPal Checkout from a product or cart page with low-value items. After PayPal authorizes the payment, the buyer returns to the Sylius order summary page instead of directly finalizing. The buyer adds higher-value items to the cart, then submits the order. Sylius accepts the finalized order because payment status is already authorized, even though PayPal only captures the original lower amount.

php

 use Sylius\Component\Core\Model\OrderInterface;
 use Sylius\Component\Core\Model\PaymentInterface;
 use Sylius\Component\Core\Model\PaymentMethodInterface;
+use Sylius\PayPalPlugin\Exception\PaymentAmountMismatchException;
 use Sylius\PayPalPlugin\Manager\PaymentStateManagerInterface;
+use Sylius\PayPalPlugin\Verifier\PaymentAmountVerifierInterface;
 
 final class PayPalOrderCompleteProcessor
 {
-    private PaymentStateManagerInterface $paymentStateManager;
-
-    public function __construct(PaymentStateManagerInterface $paymentStateManager)
-    {
-        $this->paymentStateManager = $paymentStateManager;
+    public function __construct(
+        private PaymentStateManagerInterface $paymentStateManager,
+        private ?PaymentAmountVerifierInterface $paymentAmountVerifier = null,
+    ) {
+        if (null === $this->paymentAmountVerifier) {
+            trigger_deprecation(
+                'sylius/paypal-plugin',
+                '1.6',
+                'Not passing an instance of "%s" as the second argument is deprecated and will be prohibited in 3.0.',
+                PaymentAmountVerifierInterface::class,
+            );
+        }
     }
 
     public function completePayPalOrder(OrderInterface $order): void

Source: GitHub Commit 5613df8 — the patch introduces PaymentAmountVerifierInterface and PaymentAmountMismatchException to reconcile authorized and captured amounts before order completion.

Detection Methods for CVE-2025-30152

Indicators of Compromise

Sylius orders where the finalized total exceeds the captured PayPal transaction amount reported by the PayPal API.
Order histories showing cart modification events with timestamps after a PayPal authorization event for the same session.
Repeated PayPal transactions from the same customer where captured amounts consistently fall below order totals.

Detection Strategies

Reconcile the amount field from PayPal capture webhooks against the Sylius Order.total for every completed order.
Query application logs for sequences where completePayPalOrder fires with an order total higher than the associated authorization amount.
Audit access logs for requests to cart mutation endpoints occurring between PayPal onApprove callbacks and order confirmation submissions.

Monitoring Recommendations

Enable payment-amount mismatch logging by ensuring the patched PaymentAmountVerifierInterface is wired and raising PaymentAmountMismatchException events into centralized logging.
Alert on any PaymentAmountMismatchException occurrence and treat it as a fraud signal for manual review.
Track PayPal capture-vs-order-total deltas as a business metric and trigger investigation when a per-merchant threshold is exceeded.

How to Mitigate CVE-2025-30152

Immediate Actions Required

Upgrade Sylius PayPal Plugin to 1.6.2, 1.7.2, or 2.0.2 depending on your current major version branch.
Audit historical PayPal orders for captured amounts lower than order totals and flag suspicious accounts.
Ensure the new sylius_paypal.verifier.payment_amount service is injected into PayPalOrderCompleteProcessor after upgrading.

Patch Information

The fix is delivered in commit 5613df8 and released in versions 1.6.2, 1.7.2, and 2.0.2. The patch introduces PaymentAmountVerifierInterface, which compares the PayPal-captured amount against the Sylius order total and throws PaymentAmountMismatchException when they diverge. The service is registered in src/Resources/config/services.xml and injected as the second argument to PayPalOrderCompleteProcessor. Full details are available in the GitHub Security Advisory GHSA-hxg4-65p5-9w37.

Workarounds

If immediate upgrade is not possible, disable cart modification on the order summary page by removing UI controls and blocking the underlying cart mutation routes for authenticated checkout sessions.
Implement a custom order-completion listener that queries the PayPal Orders API and rejects orders whose captured amount is below the Sylius order total.
Require manual merchant review for all PayPal orders until the plugin is patched.

bash

# Upgrade the plugin via Composer to a patched release
composer require sylius/paypal-plugin:^2.0.2
# For 1.7.x branch
composer require sylius/paypal-plugin:^1.7.2
# For 1.6.x branch
composer require sylius/paypal-plugin:^1.6.2

# Clear the Symfony container cache to load the new service wiring
php bin/console cache:clear --env=prod