The Payment Button for PayPal plugin processes checkout results through a public AJAX endpoint that accepts order details without authentication or server‑side verification of the PayPal transaction. This missing authorization check allows an unauthenticated attacker to craft POST requests that create arbitrary orders with any transaction ID, payment status, product name, amount, or customer information. If email notifications are enabled, the plugin may also send purchase receipt emails to any address supplied, resulting in database corruption and unwanted outbound email.

All WordPress sites running the Payment Button for PayPal plugin version 1.2.3.41 or earlier are affected. The vulnerability is specific to the plugin module that handles checkout via the AJAX endpoint and is present in all releases up to and including 1.2.3.41.

The CVSS score of 5.3 indicates moderate severity, while the EPSS score of less than 1% shows a very low probability of exploitation. The plugin is not listed in the CISA Known Exploited Vulnerabilities catalog, further reducing immediate risk. An attacker can exploit the flaw by sending crafted POST requests to the AJAX endpoint without user authentication. The only requirement is the ability to bypass basic parameter validation, making the vulnerability potentially exploitable by anyone with network access to the WordPress site.