CVE-2026-17012
Restore PayPal Standard for WooCommerce <= 3.1.0 - Payment Bypass via Unvalidated receiver_email
MEDIUM 5.3EPSS 0.3%
The Accept PayPal & Stripe with Subscriptions for WooCommerce WordPress plugin through 3.1.0 does not verify that the PayPal account which received a payment matches the merchant's configured account before marking the order as paid, allowing unauthenticated buyers to complete a WooCommerce order by paying the full amount to their own PayPal account instead of the merchant's.
- Affected
- Accept PayPal & Stripe with Subscriptions for WooCommerce
- CVSS v3.1 CNA
- 5.3 MEDIUM
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - EPSS
- 0.29% chance of exploitation in the next 30 days, 21st percentile
- Published
- 2026-08-10
- Updated
- 2026-08-11