WordPress Plugin Vulnerabilities

Restore PayPal Standard for WooCommerce <= 3.1.0 - Payment Bypass via PDT Underpayment

Description

The plugin does not validate the amount actually paid against the order total in its PayPal Data Transfer return handler, allowing a customer to pay less than the order total and still have the order marked as fully paid when the PayPal Data Transfer feature is enabled.

Proof of Concept

Affects Plugins

Plugin icon
restore-paypal-standard-for-woocommerce
No known fix

References

CVE
CVE-2026-17016

Classification

Type
ACCESS CONTROLS
OWASP top 10
A5: Broken Access Control
CWE
CWE-284
CVSS
3.7 (low)

Miscellaneous

Original Researcher
Muni Nitish Kumar Yaddala
Submitter
Muni Nitish Kumar Yaddala
Verified
Yes
WPVDB ID
fb73461f-521a-401b-98d0-5f32272368b8

Timeline

Publicly Published
2026-08-05 (about 5 days ago)
Added
2026-07-29 (about 12 days ago)
Last Updated
2026-07-29 (about 12 days ago)

Other

Published
Title
Published
2024-01-16
Title
User Profile Builder < 3.10.9 - Missing Authorization to Plugin Settings Change via wppb_two_factor_authentication_settings_update
Published
2021-08-23
Title
OMGF < 4.5.4 - Subscriber+ Arbitrary File/Folder Deletion
Published
2021-10-05
Title
Batch Cat <= 0.3 - Subscriber+ Arbitrary Categories Add/Set/Delete to Posts
Published
2024-12-04
Title
Related Posts, Inline Related Posts, Contextual Related Posts, Related Content By PickPlugins < 2.0.59 - Sensitive Information Exposure
Published
2020-10-16
Title
TI WooCommerce Wishlist - Authenticated WP Options Change