CVE-2026-17008: Quick Paypal Payments Auth Bypass Flaw

CVE-2026-17008 Overview

CVE-2026-17008 affects the Quick Paypal Payments WordPress plugin through version 5.7.50. The plugin's PayPal Instant Payment Notification (IPN) handler fails to verify the paid amount, receiver address, or payment status before marking an order as paid. Instead, the handler relies solely on an order-token match to complete the transaction.

A buyer who submits any arbitrary amount, even a fraction of the listed price, can trigger the plugin to mark a full-price order as paid. This is a business logic flaw in the payment verification workflow that enables merchants to lose revenue on every transaction processed through the vulnerable code path.

Critical Impact
Attackers can complete full-price orders by paying arbitrary small amounts, resulting in direct financial loss to site operators using the plugin.

Affected Products

Quick Paypal Payments WordPress plugin — all versions through 5.7.50
WordPress sites using the plugin's PayPal IPN handler for order fulfillment
E-commerce workflows depending on the plugin for payment confirmation

Discovery Timeline

2026-08-12 - CVE-2026-17008 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-17008

Vulnerability Analysis

The vulnerability is a business logic flaw in the plugin's PayPal IPN handler. The IPN protocol is designed to notify merchants of payment events, and merchants are expected to validate the notification against the original order details. This includes confirming the paid amount matches the order total, the receiver email matches the merchant account, and the payment status indicates completion.

The Quick Paypal Payments plugin bypasses these checks. When an IPN callback arrives, the handler locates the order using an order-token identifier and marks the order as paid without cross-checking any monetary or status fields. An attacker completing a legitimate PayPal payment for a nominal amount, such as one cent, produces a valid IPN that satisfies the token match. The order transitions to a paid state despite the amount being far below the price.

Root Cause

The root cause is missing input validation in the payment confirmation workflow [CWE-20, CWE-840]. The IPN handler treats the token match as authoritative rather than treating the IPN payload as untrusted data requiring field-level validation. There is no comparison between the mc_gross amount and the stored order total, no verification of the receiver_email field, and no check that payment_status equals Completed.

Attack Vector

Exploitation requires network access to the merchant site and the ability to initiate a PayPal payment. The attacker adds items to a cart, proceeds to checkout, and captures the generated order token. During the PayPal payment flow, the attacker completes payment for an arbitrary low amount. PayPal issues a legitimate IPN to the merchant endpoint referencing the order token. The plugin marks the order paid and triggers downstream fulfillment logic.

See the WPScan Vulnerability Report for additional technical detail on the IPN handler flow.

Detection Methods for CVE-2026-17008

Indicators of Compromise

Completed orders in the plugin's order log where the PayPal mc_gross value is materially lower than the recorded order total.
IPN records showing receiver_email values that do not match the configured merchant PayPal account.
Fulfillment events tied to orders whose payment amount is inconsistent with product pricing.

Detection Strategies

Reconcile plugin order records against PayPal transaction exports on a scheduled basis to identify amount mismatches.
Review web server access logs for repeated POST requests to the plugin's IPN endpoint originating from a small set of buyer accounts.
Alert on orders that transition to paid within seconds of order creation combined with unusually low payment amounts.

Monitoring Recommendations

Enable verbose logging on the WordPress site to capture full IPN request bodies received by the plugin.
Forward web server and WordPress application logs to a centralized analytics platform for correlation across order lifecycle events.
Track a rolling metric of average paid-amount versus order-total delta and alert on statistical outliers.

How to Mitigate CVE-2026-17008

Immediate Actions Required

Disable the Quick Paypal Payments plugin on affected WordPress installations until a patched release is verified.
Audit all recent completed orders for amount and receiver mismatches and reverse fulfillment for fraudulent transactions.
Rotate the merchant PayPal IPN credentials and validate that no unauthorized IPN listener URLs are configured in the PayPal account.

Patch Information

As of the NVD entry dated 2026-08-12, the vulnerability is documented as affecting the plugin through version 5.7.50. Site administrators should monitor the WPScan Vulnerability Report and the plugin's WordPress.org listing for a fixed release and upgrade as soon as a corrected version is published.

Workarounds

Replace the plugin with an alternative PayPal integration that validates mc_gross, receiver_email, and payment_status server-side against the original order.
Temporarily route PayPal checkout through PayPal-hosted buttons or a validated gateway that performs full IPN or Payment Data Transfer verification.
Implement a manual order-review step before fulfillment for any orders processed by the plugin while the patch is pending.

bash

# Configuration example: disable the plugin from the command line using WP-CLI
wp plugin deactivate quick-paypal-payments
wp plugin status quick-paypal-payments