{"affected":[{"defaultStatus":"unaffected","product":"Payment Gateway for PayPal Pro, PayPal Checkout & Subscriptions for WooCommerce","source":"CNA: VulnCheck","vendor":"wp.insider","versions":[{"lessThan":"4.1.1","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-127204","cwes":["CWE-345"],"description":"WooCommerce PayPal Pro Payment Gateway plugin before 4.1.1 contains an unauthenticated payment bypass vulnerability that allows remote attackers to mark unpaid orders as paid by exploiting the pp_capture_order AJAX handler, which is gated only by a public checkout nonce and fails to properly validate the PayPal capture response status. Attackers can supply a valid _paypal_order_id to trigger payment_complete() without verifying the capture status or amount, causing the store to fulfill goods or services that were never paid for and resulting in direct financial loss to the merchant.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":8.7,"severity":"high","source":"CNA: VulnCheck","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","version":"4.0"},{"score":7.5,"severity":"high","source":"CNA: VulnCheck","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","version":"3.1"}],"modifiedAt":1794505604117,"publishedAt":1794505604117,"references":[{"source":"CNA: VulnCheck","tags":["release-notes","patch"],"url":"https://wordpress.org/plugins/woocommerce-paypal-pro-payment-gateway/#developers"},{"source":"CNA: VulnCheck","tags":["third-party-advisory"],"url":"https://www.vulncheck.com/advisories/woocommerce-paypal-pro-payment-gateway-payment-bypass-via-pp-capture-order"}],"remediation":[{"kind":"fix","source":"CNA: VulnCheck","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://wordpress.org/plugins/woocommerce-paypal-pro-payment-gateway/#developers"}],"revision":"25c77ff96de29b122dd9869b9f8ce4de336f8624f0e048f63ea8f4ce3509d103","sources":[{"modifiedAt":1794505604117,"name":"CNA: VulnCheck","retrievedAt":1794507071655,"url":"https://www.cve.org/CVERecord?id=CVE-2026-127204"}],"ssvc":null,"status":"published","title":"WooCommerce PayPal Pro Payment Gateway < 4.1.1 Payment Bypass via pp_capture_order","updatedAt":1794507071655}