WordPress Plugin Vulnerabilities

Easy PayPal & Stripe Buy Now Button 1.8 - 2.0.5 - Unauthenticated Payment Amount Manipulation via Client-Supplied Price

Description

The plugin does not derive the payment amount on the server, taking it from a client-supplied field, so an unauthenticated attacker sets an arbitrary lower price for a purchase.

Proof of Concept

Affects Plugins

Plugin icon
wp-ecommerce-paypal
Fixed in 2.0.6

References

CVE
CVE-2026-90987

Miscellaneous

Original Researcher
JunHee CHO
Submitter
JunHee CHO
Submitter website
https://github.com/jun2e0
Verified
Yes
WPVDB ID
7c1faee8-628a-41dc-a5f0-afbc56480a18

Timeline

Publicly Published
2026-09-28 (about 4 days ago)
Added
2026-09-28 (about 3 days ago)
Last Updated
2026-09-28 (about 3 days ago)

Other

Published
Title
Published
2014-08-01
Title
blogVault 1.08 - Missing Account Empty Secret Key Generation
Published
2020-04-29
Title
WordPress < 5.4.1 - Password Reset Tokens Failed to Be Properly Invalidated
Published
2025-07-24
Title
PPWP < 1.9.11 - Subscriber+ Access Bypass via REST API
Published
2026-08-17
Title
Content Protector (Passster) < 4.3.9 - Unauthenticated Protected Content Disclosure via REST Path Allowlist Bypass
Published
2023-07-27
Title
Change WP Admin < 1.1.4 - Secret Login Page Disclosure