CVE-2026-92400: PayPal WooCommerce Auth Bypass Vulnerability

CVE-2026-92400 Overview

CVE-2026-92400 affects the Payment Gateway for PayPal on WooCommerce WordPress plugin in versions prior to 9.2.1. The plugin fails to verify that an incoming payment notification originated from the store's configured payment environment or was paid to the merchant's own PayPal account. Unauthenticated attackers can mark their own WooCommerce orders as paid by supplying a genuine transaction from an attacker-controlled PayPal sandbox. The flaw is categorized as insufficient verification of data authenticity [CWE-345] and carries an EPSS probability of 0.163%.

Critical Impact
Attackers can complete WooCommerce orders without transferring funds to the merchant, resulting in fraudulent order fulfillment.

Affected Products

Payment Gateway for PayPal on WooCommerce WordPress plugin versions before 9.2.1
WooCommerce storefronts using the affected plugin for PayPal checkout
WordPress sites accepting live PayPal payments through this integration

Discovery Timeline

2026-09-21 - CVE-2026-92400 published to NVD
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-92400

Vulnerability Analysis

The plugin processes Instant Payment Notification (IPN) callbacks from PayPal to determine whether a WooCommerce order should be marked complete. The vulnerable code path accepts these notifications without validating two critical properties: the environment that produced the transaction and the receiver merchant account. An attacker can generate a legitimate transaction inside a PayPal sandbox they control, then submit that notification to the target store. The plugin treats the sandbox-signed message as authoritative and transitions the order to a paid state. No funds ever reach the merchant, but order fulfillment proceeds as if payment had cleared.

Root Cause

The root cause is missing verification of data authenticity in the IPN handler. The handler does not confirm that the notification comes from the live PayPal environment configured by the store, nor does it check that the receiver_email or merchant ID matches the store's own PayPal account. This absence of origin and recipient validation allows any valid PayPal transaction — including sandbox transactions — to satisfy the payment check.

Attack Vector

Exploitation requires no authentication and no user interaction. An attacker places an order on the target WooCommerce store, generates a matching transaction in an attacker-owned PayPal sandbox, and delivers the resulting IPN payload to the store's callback endpoint. The plugin accepts the payload and marks the order paid. Because the attack occurs over the network against a public checkout endpoint, any exposed storefront running the vulnerable plugin is reachable.

No verified proof-of-concept code has been published. Refer to the WPScan Vulnerability Analysis for additional technical detail.

Detection Methods for CVE-2026-92400

Indicators of Compromise

Completed WooCommerce orders with no corresponding funds settled in the merchant PayPal account
IPN log entries where the test_ipn field is set to 1 or the transaction originates from sandbox.paypal.com
Order records where the receiver_email recorded in transaction metadata does not match the store's configured PayPal merchant email
Unusual spikes in completed orders followed by customer support inquiries or chargebacks

Detection Strategies

Reconcile every completed WooCommerce order against actual PayPal merchant transaction reports on a daily basis
Parse plugin IPN logs for notifications that reference sandbox endpoints or mismatched merchant identifiers
Monitor WordPress access logs for POST requests to the PayPal IPN listener from unexpected source IP ranges

Monitoring Recommendations

Enable verbose IPN logging in the plugin and forward logs to a centralized SIEM for correlation
Alert on any order marked complete without a matching entry in the PayPal settlement report
Track order fulfillment velocity and flag statistically anomalous bursts of paid orders from new customer accounts

How to Mitigate CVE-2026-92400

Immediate Actions Required

Update the Payment Gateway for PayPal on WooCommerce plugin to version 9.2.1 or later immediately
Audit all completed orders since the plugin was installed and reconcile against PayPal settlement records
Temporarily disable the affected plugin on stores that cannot patch immediately and route checkout through an alternate gateway

Patch Information

The vendor addressed the issue in version 9.2.1 of the plugin. The fix adds verification that incoming IPN messages originate from the configured live PayPal environment and are addressed to the store's own merchant account. Site administrators should apply the update through the WordPress plugin manager and confirm the installed version reports 9.2.1 or higher.

Workarounds

Configure PayPal to send IPNs only to a hardened endpoint protected by a web application firewall rule that blocks sandbox-origin traffic
Enforce manual review of all PayPal-paid orders until the patch is applied, holding fulfillment until settlement is confirmed in the merchant account
Restrict access to the WooCommerce checkout and IPN listener endpoints using IP allowlists where operationally feasible

bash

# Verify the installed plugin version via WP-CLI
wp plugin get woocommerce-paypal-payments --field=version

# Update the plugin to the patched release
wp plugin update woocommerce-paypal-payments --version=9.2.1