The Subscriptions for WooCommerce WordPress plugin prior to version 2.0.1 fails to validate a client‑supplied PayPal capture token and does not compare the captured amount to the WooCommerce order total. When the plugin receives a capture status of COMPLETED, it marks the order as paid regardless of whether the token belongs to that order or whether the amount matches. This flaw allows an attacker to place an expensive order and supply a legitimate yet uncaptured PayPal order token from another transaction, resulting in the expensive order being marked as paid without any payment actually occurring. The vulnerability enables unauthorized payment for goods or services, potentially leading to financial loss for the store owner. The attacker can exploit this flaw even when the store allows guest checkout, meaning no authentication is required to trigger the bypass. The lack of token binding and amount verification directly compromises the integrity of the payment process. The flaw is essentially a failure of authorization and validation, permitting an attacker to substitute an approved order token and pay nothing for a paid order. This could be leveraged for significant monetary fraud if an attacker repeatedly abuse the bypass.

The vulnerability affects the Subscriptions for WooCommerce WordPress plugin on all versions prior to 2.0.1. No other vendors or products are presently identified as affected.

The CVSS score for this issue is 5.9, indicating moderate severity. No EPSS score is reported, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the most likely attack vector is an unauthenticated attacker submitting a crafted PayPal capture token during the WooCommerce order‑received flow when guest checkout is active. The requirement for a valid PayPal token from a prior approved order constrains the exploit but does not eliminate it; an attacker could obtain such a token through phishing or compromise of a user account. Once the token is supplied, the plugin blindly marks the order paid, leading to fraudulent revenue or unrecouped losses for the merchant.