Quick PayPal Payments < 5.7.51 – Unauthenticated Payment Bypass via PayPal IPN | CVE 2026-17008

Description

The plugin does not verify the paid amount, receiver, or payment status in its PayPal IPN handler and marks an order paid on an order-token match alone, so a buyer who pays an arbitrary small amount can have a full-price order marked paid.

Proof of Concept

Prerequisites: a site running Quick PayPal Payments <= 5.7.50 with a published payment form for a priced item (e.g. a $100 product), using PayPal Standard checkout.

1. As an unauthenticated visitor, complete the public payment form for the full-price item ($100). The plugin stores a pending order carrying a unique `custom` token and the order total.
2. Proceed to PayPal, but pay an arbitrary small amount (e.g. $0.01) for that checkout while keeping the same `custom` token. PayPal Standard lets the buyer control the amount paid.
3. PayPal delivers a genuine VERIFIED IPN to the site's listener at https://victim.example/?qpp_ipn=1 carrying custom=<token> and mc_gross=0.01.
4. The plugin marks the full-price order as "Paid" based solely on the `custom` token match and triggers the confirmation/autoresponder, despite only $0.01 having been received. The stored order total is never compared to the amount paid, and the receiver and payment status are never verified.