The Quick Paypal Payments plugin for WordPress fails to verify the amount paid, the receiver address, or the payment status received from PayPal’s IPN (Instant Payment Notification). When the IPN handler receives a request that matches an order‑token, the plugin mistakenly treats the order as paid regardless of the actual payment details. This flaw lets a malicious user submit a small or zero‑amount IPN and have a full‑price order marked as paid, resulting in revenue loss, loss of customer trust, and potential financial fraud.

WordPress sites running the Quick Paypal Payments plugin version 5.7.50 or earlier are affected. No specific vendor name is listed beyond the plugin identifier.

The vulnerability scores a CVSS of 5.3, categorizing it as medium severity. Since the EPSS score is not available, the likelihood of exploitation is uncertain but the lack of authentication checks in the IPN handler makes it potential for unauthorized use. The vulnerability is not listed in the CISA KEV catalog. An attacker can exploit the flaw by forging IPN messages sent to the plugin’s URL, which typically accepts unauthenticated POST requests. This indirect remote attack could lead to payment fraud without needing elevated privileges.