Subscriptions for WooCommerce < 2.0.1 – Payment Bypass via Attacker-Supplied PayPal Capture Token | CVE 2026-15211

Description

The plugin does not validate the payment amount or bind the PayPal order token to the order being completed on the WooCommerce order-received flow: it captures a client-supplied token and marks the order paid whenever the capture status is COMPLETED, without comparing the captured amount to the order total. This allows an attacker (unauthenticated where guest checkout is enabled) to substitute an approved, uncaptured PayPal order token and have an expensive order marked paid without paying its price.

Proof of Concept

Prerequisites: WooCommerce active; the plugin's "WPS Paypal Payment" (wps_paypal) gateway enabled with PayPal API credentials; guest checkout enabled (WooCommerce default) so the attacker can be unauthenticated.

1. Place your own expensive Order B (e.g. $1000) selecting the "WPS Paypal Payment" gateway; it is created "pending". Note your order id (B_id) and order_key (shown to you at checkout).
2. Separately, approve a cheap $0.01 order through the same merchant's PayPal flow but do NOT let it auto-capture; keep the approved, uncaptured PayPal order token T_A (any approved uncaptured token under the merchant account works).
3. Load your $1000 order's order-received URL with T_A substituted for the token:
   curl -sSL 'https://victim.example/checkout/order-received/<B_id>/?key=<B_order_key>&token=<T_A>&PayerID=x'

Result: the order-received handler captures T_A ($0.01), PayPal returns COMPLETED, and the $1000 order is marked paid, because the captured amount is never compared to the order total and the token is never bound to the order. The merchant fulfils $1000 of goods/subscription for $0.01.