Premium Packages < 7.2.1 – Unauthenticated PayPal Webhook Signature Verification Bypass | CVE 2026-93511

Description

The plugin does not verify PayPal's webhook signature before processing payment and subscription notifications, allowing unauthenticated attackers to forge payment confirmations and subscription-cancellation events against any order whose transaction id they know.

Proof of Concept

Prerequisites

- A known transaction id (trans_id / billing_agreement_id) for the target order. An attacker's own id, legitimately obtained from their own prior transaction, is sufficient to affect their own order; a victim's id would be needed to affect someone else's.

Steps — mark an order paid for free

1. Send a forged webhook POST with no authentication and no PayPal signature headers:

curl -X POST https://victim.example/wp-json/wpdmpp/v1/paypal/webhook \
  -H "Content-Type: application/json" \
  -d '{"event_type":"PAYMENT.SALE.COMPLETED","resource":{"billing_agreement_id":"&lt;known-trans-id&gt;"}}'

2. The response confirms the order was updated. The matching order flips to Completed/Completed and its expiry extends by a full validity period, with no payment having occurred.

Steps — cancel a subscription

3. The same technique with event_type set to BILLING.SUBSCRIPTION.CANCELLED (or SUSPENDED/EXPIRED) against a known trans_id disables auto-renew or cancels the matching order, unauthenticated.