The SKT PayPal for WooCommerce plugin for WordPress has a flaw that allows unauthenticated users to bypass payment checks. Because the plugin relies only on client‑side controls when processing orders, an attacker can submit a purchase request and receive a confirmed transaction without actual funds being transferred. This leads to financial loss for the site owner and can result in fraudulent orders. The weakness is a failure to enforce server‑side validation, aligning with CWE‑602.

The vulnerable product is SKT PayPal for WooCommerce by sonalsinha21. All releases with a version number of 1.4 or earlier are affected. Administrators operating WordPress sites that install or use any of these releases should be aware that the plugin is lacking proper server‑side checks.

The CVSS base score of 7.5 places the issue in the high severity range. The EPSS score of less than 1% indicates a low probability of exploitation at this time, and the vulnerability is not yet listed in CISA KEV. Based on the description, the likely attack vector is a crafted HTTP request to the plugin’s payment endpoint that bypasses authentication checks. The vulnerability resides in front‑end logic, so it could be abused remotely over the public internet on any instance that does not restrict access to the payment processing route; this inference comes from the lack of server‑side validation. The lack of server‑side validation makes the risk high when exercised.