The PayPal Payment Gateway for WooCommerce plugin fails to verify that an incoming payment notification belongs to the store’s live environment or corresponds to the store’s merchant account before marking an order as complete. This allows an unauthenticated attacker who controls a PayPal sandbox transaction to submit a valid IPN message that the site treats as a real payment, effectively bypassing payment confirmation. The result is that orders can be completed without real funds being received, leading to fraudulent revenue loss for the merchant and potential customer disputes.

All installations of the PayPal Payment Gateway for WooCommerce plugin version below 9.2.1 on WordPress sites are affected. The vulnerability is present regardless of the WordPress core or WooCommerce version because it resides entirely within the plugin code.

The CVSS score of 5.3 indicates medium severity; the EPSS score is not listed, suggesting a lack of quantitative data on exploit prevalence, and the vulnerability is not yet in CISA’s KEV catalog. The attack vector is inferred to be external and internet‑connected: an attacker must have the ability to create a sandbox transaction with PayPal and send an IPN request to the store’s endpoint. Once the IPN is received, the store accepts it as a legitimate payment due to the lack of environment and merchant validation checks. The exploitation does not require privileged credentials on the target site; it merely leverages the plugin’s failure to authenticate the source of the IPN.