Payment Gateway for PayPal on WooCommerce < 9.2.1 – Unauthenticated Payment Bypass via PayPal Advanced Return Handler | CVE 2026-16621

Description

The plugin does not verify that payment actually succeeded before completing an order in its PayPal return handler: it reads attacker-controlled parameters, performs no amount comparison and no order-ownership check, and completes the order even when the server-side gateway verification fails, allowing an unauthenticated attacker to mark arbitrary orders as paid without paying.

Proof of Concept

The PayPal Advanced (PayFlow) return handler is registered for unauthenticated users and completes an order with no nonce, capability, order-ownership/order-key, or amount check. On a claimed-success return it performs a server-side PayFlow inquiry on an attacker-supplied transaction reference; when that inquiry does not return an authorized transaction (which includes it failing for a forged reference), an else-branch still completes the order.

Prerequisites: WooCommerce active; the PayPal Advanced gateway configured at least once so its settings option exists (it may be left disabled). An unpaid/pending order exists; its id can be supplied via INVOICE (order ids are sequential).

1. As an unauthenticated guest (no account, no cookies, no nonce), POST to the return endpoint with the target order id and an arbitrary transaction reference:

   curl 'https://victim.example/?wc-api=woo_paypal_gateway_paypal_advanced' \
        --data 'RESULT=0&INVOICE=<ORDER_ID>&PNREF=ATTACKER_FAKE_TXN'

   The server responds HTTP 302 redirecting to /checkout/order-received/<ORDER_ID>/.

2. The order is now marked paid:
   - Before: status pending, is_paid()=false, no transaction id.
   - After: status processing, is_paid()=true, transaction_id=ATTACKER_FAKE_TXN, date_paid set, with no actual payment.

This marks an arbitrary WooCommerce order paid without paying. Reproduced on 9.0.65 and current 9.1.5 (the return handler is byte-identical; the 9.1.5 "order rebinding" fix applies to the separate PPCP capture path, not this PayFlow handler).