This vulnerability allows an attacker who can send a crafted IPN request to the Subscriptions & Memberships for PayPal plugin to create payout records that never occurred, effectively allowing unauthorized creations of payment entries. The flaw stems from a failure to validate the authenticity of IPN notifications, which means the plugin does not verify that the request actually came from PayPal. This weakness is classified as CWE‑345, representing insufficient verification of source integrity.

The affected product is the WordPress plugin Subscriptions & Memberships for PayPal, developed by scottpaterson, in all releases up to and including version 1.1.7.

The CVSS score of 5.3 indicates a moderate impact, and the EPSS score of less than 1% suggests that exploitation is unlikely at this time. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw by sending a malicious IPN POST request directly to the plugin’s public endpoint without needing authentication. Successful exploitation could result in fake payment entries that do not reflect real transactions, potentially affecting the site’s financial logs.