WordPress Plugin Vulnerabilities

SKT PayPal for WooCommerce < 1.5 - Unauthenticated Payment Bypass

Description

The plugin is vulnerable to Payment Bypass due to the plugin only enforcing client side controls instead of server-side controls when processing payments. This makes it possible for unauthenticated attackers to make confirmed purchases without actually paying for them.

Affects Plugins

Plugin icon
skt-paypal-for-woocommerce
Fixed in 1.5

References

CVE
CVE-2025-7820
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/1a67b1b3-eb39-4e9a-ba44-ea637fc3bba1

Miscellaneous

Original Researcher
ch4r0n
Verified
No
WPVDB ID
5ef963f4-c146-4219-990a-3845558880d8

Timeline

Publicly Published
2025-11-26 (about 4 months ago)
Added
2025-11-27 (about 4 months ago)
Last Updated
2025-11-27 (about 4 months ago)

Other

Published
Title
Published
2017-05-16
Title
WordPress 2.5.0-4.7.4 - Post Meta Data Values Improper Handling in XML-RPC
Published
2022-11-29
Title
Appointment Hour Booking < 1.3.73 - CAPTCHA Bypass
Published
2020-12-14
Title
Limit Login Attempts Reloaded < 2.17.4 - Login Rate Limiting Bypass
Published
2019-01-25
Title
Total Donations - Update Arbitrary WordPress Option Values
Published
2022-04-07
Title
SiteGround Security < 1.2.6 - Authorization Weakness to Authentication Bypass via 2-FA Back-up Codes