CVE-2026-17012: WooCommerce PayPal Auth Bypass Vulnerability

CVE-2026-17012 Overview

CVE-2026-17012 affects the Accept PayPal & Stripe with Subscriptions for WooCommerce WordPress plugin through version 3.1.0. The plugin fails to verify that the PayPal account receiving a payment matches the merchant's configured account before marking a WooCommerce order as paid. Unauthenticated buyers can complete orders by paying the full amount to their own PayPal account rather than the merchant's account. The flaw is a broken access control issue tracked under CWE-284 and represents a business logic bypass in the payment verification workflow.

Critical Impact
Attackers can fraudulently complete WooCommerce orders by redirecting PayPal payments to attacker-controlled accounts while the store still marks the orders as paid.

Affected Products

Accept PayPal & Stripe with Subscriptions for WooCommerce WordPress plugin, versions through 3.1.0
WooCommerce stores running the affected plugin with PayPal payment flows enabled
WordPress sites that rely on this plugin for order fulfillment automation

Discovery Timeline

2026-08-10 - CVE-2026-17012 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-17012

Vulnerability Analysis

The vulnerability is a business logic flaw in the plugin's PayPal payment confirmation handler. The plugin accepts a payment notification and marks the associated WooCommerce order as paid without validating the recipient PayPal account. An attacker completes checkout, then pays the correct order total to a PayPal account they control instead of the merchant's configured account. The plugin observes a successful PayPal transaction for the expected amount and transitions the order to a paid state. The merchant fulfills the order without ever receiving funds.

The issue affects integrity of order state rather than confidentiality or availability, which is reflected in the attack vector being remote and unauthenticated over the network.

Root Cause

The root cause is missing authorization on the payment recipient identity. Per CWE-284: Improper Access Control, the plugin does not compare the payee_email or PayPal merchant ID returned in the transaction data against the store's configured receiver account. Without this check, any PayPal transaction of the correct amount and currency is treated as valid proof of payment.

Attack Vector

Exploitation requires no authentication and no user interaction beyond a normal checkout flow. An attacker adds items to the cart, initiates checkout using the affected PayPal payment path, and completes payment to their own PayPal account for the exact order total. The plugin's callback handler processes the transaction data and marks the order as paid. See the WPScan Vulnerability Database Entry for additional technical detail.

No verified exploitation code is publicly available. The vulnerability is described in prose based on vendor and researcher disclosures.

Detection Methods for CVE-2026-17012

Indicators of Compromise

WooCommerce orders marked as paid without corresponding deposits in the merchant's PayPal transaction history
PayPal IPN or webhook records where the receiver_email or payee field does not match the store's configured merchant account
Repeated successful orders from new or low-reputation customer accounts followed by fulfillment requests

Detection Strategies

Reconcile WooCommerce order status against PayPal settlement reports on a daily cadence and alert on mismatches
Parse plugin transaction logs and flag entries where the recorded payee identifier differs from the merchant's configured account
Monitor WordPress access logs for repeated POSTs to the plugin's PayPal return or IPN endpoints from atypical IP ranges

Monitoring Recommendations

Enable verbose logging on the WooCommerce payment gateway and retain logs for at least 90 days
Alert on order fulfillment events that lack a matching entry in the PayPal merchant settlement feed
Track version metadata of the plugin across all managed WordPress instances to identify unpatched sites

How to Mitigate CVE-2026-17012

Immediate Actions Required

Disable the Accept PayPal & Stripe with Subscriptions for WooCommerce plugin until a fixed version is installed
Switch active PayPal checkout flows to an alternative gateway with verified receiver validation
Audit orders placed since the plugin was deployed and reconcile each against merchant PayPal deposits

Patch Information

At the time of publication, no fixed version beyond 3.1.0 is referenced in the NVD entry. Monitor the WPScan Vulnerability Database Entry and the plugin's WordPress.org page for a patched release. Apply the update across all environments immediately once available.

Workarounds

Place the WordPress site behind a web application firewall rule that blocks unauthenticated requests to the plugin's PayPal callback endpoints from unexpected sources
Configure order fulfillment to require manual approval until reconciliation with PayPal settlement data is confirmed
Remove PayPal as an available payment method in WooCommerce settings while the plugin remains vulnerable

bash

# Disable the vulnerable plugin via WP-CLI
wp plugin deactivate accept-stripe-payments-subscriptions

# Verify plugin status and installed version
wp plugin get accept-stripe-payments-subscriptions --field=version