CVE-2026-9284: WooCommerce PayPal Auth Bypass Flaw

CVE-2026-9284 Overview

CVE-2026-9284 is a missing authorization vulnerability [CWE-862] in the WooCommerce PayPal Payments plugin for WordPress. The flaw affects all versions up to and including 4.0.1. Two WC-AJAX endpoints, ppc-create-order and ppc-get-order, fail to enforce ownership checks on WooCommerce order identifiers. Unauthenticated attackers can chain the endpoints to manipulate other customers' payment flows and exfiltrate order details including payer information and shipping data. The vulnerability carries a network attack vector with low complexity and requires no user interaction.

Critical Impact
Unauthenticated attackers can create PayPal orders against arbitrary WooCommerce order IDs and retrieve full PayPal order data, exposing customer payer and shipping information across affected stores.

Affected Products

WooCommerce PayPal Payments plugin for WordPress, all versions up to and including 4.0.1
WordPress sites running WooCommerce with the affected plugin enabled
E-commerce deployments exposing the ppc-create-order and ppc-get-order WC-AJAX endpoints

Discovery Timeline

2026-05-23 - CVE-2026-9284 published to NVD
2026-05-26 - Last updated in NVD database

Technical Details for CVE-2026-9284

Vulnerability Analysis

The vulnerability resides in two WC-AJAX endpoints exposed by the WooCommerce PayPal Payments plugin. The ppc-create-order endpoint accepts an arbitrary WooCommerce order ID in the pay-now context. It does not validate that the requester owns the referenced order. An attacker can therefore initiate a PayPal order against any existing WooCommerce order and write PayPal metadata to it.

The ppc-get-order endpoint compounds the issue. It returns full PayPal order details for any PayPal order ID supplied in the request. The endpoint does not bind the response to the requester's session or to ownership of the underlying WooCommerce order.

Chaining the two endpoints lets an unauthenticated attacker target a victim's WooCommerce order, generate a PayPal order tied to it, and then retrieve sensitive payer and shipping information from the PayPal record. Confidentiality impact is high while integrity is limited to PayPal metadata writes on the targeted order.

Root Cause

The root cause is missing authorization [CWE-862] in the endpoint handlers defined in CreateOrderEndpoint.php and GetOrderEndpoint.php within the ppcp-button module. The handlers accept caller-supplied identifiers without comparing them against the active session, cart, or customer record. See the WooCommerce PayPal Create Order source and WooCommerce PayPal Get Order source.

Attack Vector

The attack vector is network-based and requires no authentication. An attacker enumerates or guesses WooCommerce order IDs, posts to the ppc-create-order WC-AJAX endpoint with the target order ID in the pay-now context, captures the returned PayPal order ID, and then calls ppc-get-order to read payer and shipping data. The behavior maps to insecure direct object reference patterns combined with broken access control.

No verified public exploit code is available at the time of publication. Technical details are documented in the Wordfence Vulnerability Analysis and the WooCommerce PayPal Changeset Update.

Detection Methods for CVE-2026-9284

Indicators of Compromise

Unauthenticated POST requests to /?wc-ajax=ppc-create-order containing a context=pay-now parameter and a WooCommerce order ID that does not match the session cart
Unauthenticated POST or GET requests to /?wc-ajax=ppc-get-order referencing PayPal order IDs without a matching prior session-initiated checkout
Unexpected PayPal metadata fields written to WooCommerce orders that were not in an active checkout state
High-volume sequential access to WC-AJAX endpoints from a single source IP indicating order ID enumeration

Detection Strategies

Inspect web server access logs for wc-ajax=ppc-create-order and wc-ajax=ppc-get-order requests originating from unauthenticated sessions
Correlate ppc-create-order calls with subsequent ppc-get-order calls from the same source within short time windows
Alert on WooCommerce orders that receive PayPal metadata updates without a corresponding logged-in customer action

Monitoring Recommendations

Enable verbose access logging for all WC-AJAX endpoints and forward logs to a centralized SIEM
Track baseline volumes for PayPal checkout endpoints and alert on deviations
Monitor WooCommerce order audit logs for metadata writes that lack an associated user session

How to Mitigate CVE-2026-9284

Immediate Actions Required

Update the WooCommerce PayPal Payments plugin to a version later than 4.0.1 that addresses the missing authorization checks
Audit recent WooCommerce orders for unauthorized PayPal metadata writes and notify affected customers if payer or shipping data may have been disclosed
Restrict access to the /?wc-ajax=ppc-create-order and /?wc-ajax=ppc-get-order paths at the WAF layer until patching is confirmed

Patch Information

The vendor addressed the issue in a plugin update tracked in the WooCommerce PayPal Changeset Update. Administrators should upgrade to the latest available release of the WooCommerce PayPal Payments plugin from the WordPress plugin repository. Refer to the Wordfence advisory for fixed version details.

Workarounds

Deploy a WAF rule that blocks unauthenticated requests to wc-ajax=ppc-create-order and wc-ajax=ppc-get-order
Temporarily disable the WooCommerce PayPal Payments plugin and fall back to an alternative payment gateway until the patch is applied
Enforce rate limiting on WC-AJAX endpoints to slow order ID enumeration attempts

bash

# Example ModSecurity rule blocking unauthenticated access to affected endpoints
SecRule REQUEST_URI "@rx wc-ajax=(ppc-create-order|ppc-get-order)" \
  "id:1029284,\
   phase:2,\
   deny,\
   status:403,\
   chain,\
   msg:'CVE-2026-9284 WooCommerce PayPal Payments missing authorization'"
  SecRule &REQUEST_COOKIES:wordpress_logged_in_* "@eq 0"