CVE-2026-16990: PayPal Payment Button Auth Bypass Flaw

CVE-2026-16990 Overview

CVE-2026-16990 affects the Payment Button for PayPal WordPress plugin through version 1.2.3.44. The plugin does not enforce the merchant-configured price on the server side. Instead, it trusts a client-supplied payment amount when creating PayPal orders. Unauthenticated attackers can submit an arbitrary lower amount and complete a real PayPal transaction against the merchant. The flaw is a business logic error [CWE-472 / CWE-807] rooted in improper input validation of price parameters. Merchants running affected versions face direct revenue loss on every checkout attempt an attacker manipulates.

Critical Impact
Unauthenticated attackers can purchase products at attacker-chosen prices, resulting in direct financial loss to WordPress merchants using the plugin.

Affected Products

Payment Button for PayPal WordPress plugin, versions up to and including 1.2.3.44
WordPress sites with the plugin active and configured for PayPal checkout
Any merchant relying on client-side price enforcement through this plugin

Discovery Timeline

2026-08-12 - CVE-2026-16990 published to the National Vulnerability Database
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-16990

Vulnerability Analysis

The Payment Button for PayPal plugin generates PayPal orders using a payment amount that originates from the client request. The plugin does not cross-check this value against the merchant-configured price stored in the WordPress database. An attacker can intercept or craft the checkout request and substitute a lower amount. PayPal then processes a legitimate order at the attacker-controlled price, and the merchant fulfills the purchase without noticing the discrepancy.

This is a classic server-side trust boundary failure. The plugin treats the browser as authoritative for pricing, which violates the principle that all security-relevant validation must occur server-side. Because the endpoint accepts unauthenticated requests, no account, session, or CSRF token is required. The vulnerability does not expose data or crash the site, but it directly undermines transaction integrity.

Root Cause

The root cause is missing server-side validation of the price parameter during PayPal order creation. The plugin reads the amount from the HTTP request and forwards it to the PayPal Orders API without reconciling it against the product record configured in WordPress admin.

Attack Vector

An attacker loads the checkout page, captures the outbound request that triggers PayPal order creation, and modifies the amount field to an arbitrary lower value such as 0.01. The modified request is replayed to the vulnerable endpoint. The plugin accepts the tampered amount and creates a real PayPal order for that value. The attacker completes payment through PayPal and receives an order confirmation for the product at the reduced price. No authentication is required, and the attack scales through simple HTTP automation.

For technical details, refer to the WPScan Vulnerability Report.

Detection Methods for CVE-2026-16990

Indicators of Compromise

PayPal order records with transaction amounts that do not match the merchant-configured product price
Repeated successful checkout completions from the same IP address for anomalously low amounts
Web server access logs showing POST requests to the plugin's order-creation endpoint with unusual amount parameter values

Detection Strategies

Reconcile PayPal transaction reports against the WordPress product catalog on a scheduled basis and alert on price mismatches
Deploy a Web Application Firewall (WAF) rule that inspects requests to the plugin endpoint and flags amount values below configured product prices
Enable verbose logging on the plugin's AJAX handlers to capture the raw amount parameter submitted by clients

Monitoring Recommendations

Monitor PayPal merchant dashboards daily for orders under a minimum expected threshold
Track fulfillment queues for orders paid at prices inconsistent with the storefront listing
Alert on bursts of low-value completed transactions originating from a narrow set of source IPs or user agents

How to Mitigate CVE-2026-16990

Immediate Actions Required

Deactivate the Payment Button for PayPal plugin until a patched version is confirmed available
Audit recent PayPal transactions and compare amounts against the merchant-configured product prices
Hold fulfillment on orders that show price anomalies pending manual verification

Patch Information

At the time of publication, no fixed version has been listed. Versions through 1.2.3.44 are vulnerable. Monitor the WPScan Vulnerability Report and the plugin's WordPress.org listing for an updated release, and apply it as soon as it becomes available.

Workarounds

Replace the plugin with an alternative PayPal integration that performs server-side price enforcement
Add a WAF rule that rejects requests to the plugin's order endpoint when the submitted amount falls below the product's configured price
Route PayPal checkouts through a server-side proxy that overwrites the amount field with the authoritative price from the WordPress database before forwarding to PayPal

bash

# Example WAF rule concept (ModSecurity)
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
    "chain,phase:2,deny,status:403,id:1026169901,\
    msg:'CVE-2026-16990 PayPal price tampering attempt'"
    SecRule ARGS:action "@streq paypal_create_order" \
        "chain"
        SecRule ARGS:amount "@lt 1.00"