HIGHVulnerability
Verified
Global

NVD HIGH: CVE-2026-9284 — The WooCommerce PayPal Payments plugin for WordPress is vulnerable to unauthoriz...

·Source: NIST NVD

Updated:

Executive Summary

The WooCommerce PayPal Payments plugin for WordPress is vulnerable to unauthorized order manipulation and information disclosure due to missing authorization checks on the `ppc-create-order` and `ppc-get-order` WC-AJAX endpoints in all versions up to, and including, 4.0.1. The `ppc-create-order` endpoint accepts an arbitrary WooCommerce order ID in the `pay-now` context without validating order ow

Analysis

The WooCommerce PayPal Payments plugin for WordPress is vulnerable to unauthorized order manipulation and information disclosure due to missing authorization checks on the `ppc-create-order` and `ppc-get-order` WC-AJAX endpoints in all versions up to, and including, 4.0.1. The `ppc-create-order` endpoint accepts an arbitrary WooCommerce order ID in the `pay-now` context without validating order ownership, allowing attackers to create PayPal orders for any WC order and write PayPal metadata to it. The `ppc-get-order` endpoint returns full PayPal order details for any PayPal order ID without binding to the requester's session. This makes it possible for unauthenticated attackers to chain these endpoints to manipulate other customers' order payment flows and exfiltrate sensitive order details (payer information, shipping data) by creating a PayPal order for a victim's WC order and then retrieving the PayPal order data. CVSS Score: 8.2. Published: 2026-05-23T05:16:34.980.

Indicators of Compromise (1)

CVE (1)
CVE-2026-9284
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on May 23, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerabilityNEW

ThinkMarkets launches Ai assistant for CFD trading

ThinkMarkets (www.ThinkMarkets.com) today launches ChelseaAI, a product that connects a live ThinkTrader account directly to an AI assistant.

Finextra
MEDIUMVulnerabilityNEW

Beyond Assume-Breach: How AI-Native Security Will Reshape Enterprise Defense

Twenty years after Dark Reading launched, we're looking ahead at what's next for enterprise security. Spoiler: It's hyper-segmented, AI-orchestrated, and way more sophisticated than your dad's firewall.

Dark Reading
MEDIUMVulnerabilityNEW

Eventus names Eric Litz as CTo and Sarah-Jane McColl as chief customer officer

Eventus, a leading provider of comprehensive, at-scale trade surveillance and financial risk solutions, today announced the expansion of its leadership team with the appointment of Eric Litz as Chief Technology Officer (CTO) and Sarah-Jane McColl as Chief Customer Officer (CCO).

Finextra