CVE-2026-17016: WooCommerce PayPal Plugin Auth Bypass Flaw

CVE-2026-17016 Overview

CVE-2026-17016 affects the Accept PayPal & Stripe with Subscriptions for WooCommerce WordPress plugin through version 3.1.0. The plugin fails to validate the paid amount against the order total inside its PayPal Data Transfer (PDT) return handler. When the PDT feature is enabled, a customer can submit a lower payment amount and still have the order marked as fully paid. The flaw is categorized under [CWE-284] Improper Access Control and represents a business logic error in the payment reconciliation flow.

Critical Impact
Attackers with customer-level access can complete WooCommerce orders while paying less than the required total, causing direct financial loss to store operators.

Affected Products

Accept PayPal & Stripe with Subscriptions for WooCommerce plugin, all versions through 3.1.0
WordPress sites running the plugin with PayPal Data Transfer enabled
WooCommerce stores relying on PDT return handling for order confirmation

Discovery Timeline

2026-08-10 - CVE-2026-17016 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-17016

Vulnerability Analysis

The vulnerability resides in the plugin's PayPal Data Transfer return handler. PDT is a PayPal mechanism that returns transaction details to the merchant after a buyer completes checkout. A correct implementation must compare the mc_gross (amount paid) value from PayPal against the WooCommerce order total before marking the order complete.

In versions through 3.1.0, the plugin trusts the PDT response as proof of payment without reconciling the actual amount paid against the expected order total. A customer who intercepts the checkout flow and submits a modified payment amount to PayPal receives a valid PDT confirmation. The plugin then transitions the order to a paid state regardless of the discrepancy.

The attack requires the PDT feature to be enabled and depends on customer interaction with the PayPal checkout flow, which explains the higher attack complexity. The impact is limited to integrity of the order/payment record; confidentiality and availability are not affected.

Root Cause

The root cause is missing server-side validation of a security-relevant value received from an external service. The PDT handler processes transaction identifiers and status codes but omits an equality check between the returned payment amount and the stored WooCommerce order total.

Attack Vector

Exploitation proceeds over the network without authentication beyond a standard customer checkout. An attacker initiates a WooCommerce checkout, manipulates the PayPal payment flow to submit a lower amount, and returns to the store via the PDT callback URL. The plugin accepts the callback and finalizes the order. Technical details are documented in the WPScan Vulnerability Details.

Detection Methods for CVE-2026-17016

Indicators of Compromise

WooCommerce orders marked as completed or processing where the PayPal transaction amount is less than the order total
PDT callback requests in web server logs referencing order IDs with mismatched mc_gross values
Unusual patterns of successful low-value payments for high-value products from the same customer accounts or IP ranges

Detection Strategies

Reconcile WooCommerce order totals against PayPal transaction reports on a scheduled basis to surface underpaid orders
Inspect plugin PDT handler log entries for transactions where the received amount deviates from the expected total
Alert on repeated checkouts from a single customer that use the PayPal PDT flow with abnormally low amounts

Monitoring Recommendations

Enable WooCommerce order notes and PayPal API logging to capture full PDT response payloads for forensic review
Monitor WordPress access logs for requests to the plugin's PDT return endpoint and correlate with order state transitions
Track order status changes from pending to processing/completed and flag entries lacking a matching full-amount payment record

How to Mitigate CVE-2026-17016

Immediate Actions Required

Disable the PayPal Data Transfer feature in the plugin settings until a patched version is available
Switch to PayPal Instant Payment Notification (IPN) or PayPal API-based confirmation where amount validation is enforced
Audit recent orders processed through the PDT flow and reconcile them against PayPal transaction history

Patch Information

At the time of publication, no fixed version beyond 3.1.0 is listed in the referenced advisory. Store operators should monitor the WPScan Vulnerability Details page and the plugin's WordPress.org listing for a security release, then upgrade immediately upon availability.

Workarounds

Turn off the PDT return handler and rely on IPN callbacks that validate the transaction amount server-side
Implement a custom WooCommerce hook that verifies mc_gross against the order total before allowing the status transition
Restrict order fulfillment automation so that manual review is required for any order completed via the PDT flow

bash

# WooCommerce reconciliation query (WP-CLI) to surface underpaid orders
wp db query "SELECT p.ID AS order_id, pm1.meta_value AS order_total, pm2.meta_value AS paid_amount \
  FROM wp_posts p \
  JOIN wp_postmeta pm1 ON p.ID = pm1.post_id AND pm1.meta_key = '_order_total' \
  JOIN wp_postmeta pm2 ON p.ID = pm2.post_id AND pm2.meta_key = '_paypal_mc_gross' \
  WHERE p.post_type = 'shop_order' \
    AND p.post_status IN ('wc-processing','wc-completed') \
    AND CAST(pm2.meta_value AS DECIMAL(10,2)) < CAST(pm1.meta_value AS DECIMAL(10,2));"