The plugin fails to verify a completed payment before marking an order as paid. It accepts attacker‑controlled parameters from the PayPal return, performs no amount comparison, no order‑ownership check, and still completes the order even when server‑side verification fails. This gives an unauthenticated attacker the ability to mark any order as paid without actually completing payment, providing unauthorized access to paid goods or services. The flaw is a form of improper input validation (CWE‑20) that undermines confidentiality and integrity of transactional data.

Impactful are installations of the WordPress “Payment Gateway for PayPal on WooCommerce” plugin with version numbers lower than 9.2.1. The vulnerability exists in all sites running the plugin before this release, regardless of other plugins or WooCommerce version, because the return handler is unprotected.

The CVSS score of 5.3 indicates moderate severity, but the vulnerability can be abused without authentication or elevated privileges. No EPSS value is available, and the vulnerability is not listed in CISA KEV yet, yet the lack of verification logic makes exploitation straightforward. An attacker only needs to trigger the PayPal return endpoint with manipulated parameters, which is likely possible from the attacker’s own device or by malicious IP, to cause orders to be marked as paid.