Veille CVE

Recherche « Unknown Payment Gateway for PayPal on WooCommerce »

3 CVE

Critique 0 Élevée 0 Moyenne 3 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Unknown Payment Gateway for PayPal on WooCommerce » ✕
  1. CVE-2026-92400 5.3 Moyenne

    Unknown Payment Gateway for PayPal on WooCommerce

    The Payment Gateway for PayPal on WooCommerce WordPress plugin before 9.2.1 does not verify that an incoming payment notification was confirmed in the store's configured payment environment or paid to the store's own merchant account before marking an order complete, allowing unauthenticated users to mark their own orders as paid using a genuine transaction from a payment sandbox they control.

  2. CVE-2026-91019 4.9 Moyenne

    Unknown Event Booking Manager for WooCommerce

    The Event Booking Manager for WooCommerce WordPress plugin before 5.6.0 does not restrict who can view its stored payment gateway configuration, allowing users with Contributor-level access and above to read the site's PayPal and Stripe credentials, including their secret keys.

  3. CVE-2026-16621 5.3 Moyenne

    Unknown Payment Gateway for PayPal on WooCommerce

    The Payment Gateway for PayPal on WooCommerce WordPress plugin before 9.2.1 does not verify that payment actually succeeded before completing an order in its PayPal return handler: it reads attacker-controlled parameters, performs no amount comparison and no order-ownership check, and completes the order even when the server-side gateway verification fails, allowing an unauthenticated attacker to mark arbitrary orders as paid without paying.