The Order Tracking WordPress plugin version 3.6.0 and earlier does not verify that a PayPal payment notification was sent to the merchant's account or that the reported amount matches the order total before marking an order as paid. An unauthenticated attacker can forge a valid IPN message by using a trivial payment from their own PayPal account, causing arbitrary orders to be marked as paid. This can lead to fraudulent order processing and financial loss. The weakness is improper input validation and missing authentication of external notifications (CWE-287, CWE-20).

WordPress sites that install the Order Tracking plugin before 3.6.0. Any vendor of the plugin is unknown, but the plugin is accessible through the WordPress ecosystem. The exploit targets the plugin's PayPal IPN endpoint available on sites using this plugin.

The vulnerability has a CVSS score of 5.3, indicating a moderate risk. EPSS data is not available, but the exploit relies on sending a crafted PayPal notification to the plugin listener, which is a low‑effort, unauthenticated attack vector. The vulnerability is not currently listed in the CISA KEV catalog, suggesting no known large‑scale exploitation yet. Nevertheless, an attacker with a PayPal account can trigger the exploit by posting the forged IPN to the site’s URL, leading to unauthorized order confirmation. The lack of verification of the notification means the danger amounts to fraudulent payment marking, but it does not allow code execution or system takeover.