CVE-2026-15211: 
WordPress vulnerability analysis and mitigation

CVE-2026-15211 is a payment bypass vulnerability in the "Subscriptions for WooCommerce" WordPress plugin (by WP Swings) that allows attackers to substitute an attacker-controlled PayPal order token to mark expensive orders as paid without paying the correct amount. All plugin versions before 2.0.1 are affected. The vulnerability was publicly disclosed on August 3, 2026, and published to the NVD on August 7, 2026. It carries a CVSS v3.1 base score of 5.9 (Medium) (WPScan, Github Advisory).

The root cause is classified as CWE-345 (Insufficient Verification of Data Authenticity): the plugin's WooCommerce order-received flow accepts a client-supplied PayPal order token without binding it to the specific WooCommerce order or validating that the captured amount matches the order total. When the plugin receives a PayPal capture response with status COMPLETED, it unconditionally marks the associated WooCommerce order as paid. An attacker exploits this by obtaining any approved, uncaptured PayPal token (e.g., from a $0.01 transaction under the same merchant account) and injecting it into the order-received URL of a high-value order. A proof-of-concept demonstrating this technique was published by researcher Pedro Pinho alongside the disclosure (WPScan).

Successful exploitation allows an unauthenticated attacker (when guest checkout is enabled, which is the WooCommerce default) to obtain goods, services, or subscriptions of arbitrary value while paying only a nominal amount (e.g., $0.01). The integrity impact is high — order payment records are falsified — while there is no confidentiality or availability impact. Merchants using the affected plugin with the WPS PayPal Payment gateway are directly exposed to financial loss and fraudulent order fulfillment (WPScan, Github Advisory).

A proof-of-concept exploit was published by the original researcher (Pedro Pinho) as part of the WPScan disclosure, demonstrating the attack with a simple curl command. There is no evidence of in-the-wild exploitation or threat actor attribution at this time. The vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.111% (2nd percentile), indicating a low near-term exploitation probability. Exploitation requires the WPS PayPal Payment gateway to be enabled and configured with valid PayPal API credentials, and is easiest when guest checkout is active (WPScan, Github Advisory).

1. Reconnaissance: Identify WooCommerce stores running the "Subscriptions for WooCommerce" plugin (version < 2.0.1) with the "WPS Paypal Payment" (wps_paypal) gateway enabled and guest checkout active.
2. Place a high-value order: As an unauthenticated user, add an expensive item (e.g., $1000 subscription) to the cart and proceed to checkout using the WPS PayPal Payment gateway. Note the resulting WooCommerce order ID (B_id) and order_key.
3. Obtain a cheap approved PayPal token: Separately initiate a legitimate PayPal checkout for a minimal amount (e.g., $0.01) through the same merchant's PayPal flow. Approve the PayPal order but do NOT allow it to auto-capture; retain the approved, uncaptured PayPal order token (T_A).
4. Substitute the token: Craft a request to the high-value order's order-received URL, replacing the legitimate token with T_A:

   curl -sSL 'https://victim.example/checkout/order-received/<B_id>/?key=<order_key>&token=<T_A>&PayerID=x'

5. Order marked paid: The plugin captures T_A ($0.01), PayPal returns COMPLETED, and the $1000 WooCommerce order is marked as paid — because the captured amount is never compared to the order total and the token is never bound to the order. The merchant fulfills the subscription or goods without receiving full payment (WPScan).

• Network: Unexpected GET requests to /checkout/order-received/<order_id>/ with token and PayerID query parameters that differ from those generated during the original checkout session; requests originating from IPs not associated with the original order placement.
• Logs: WooCommerce order logs showing high-value orders transitioning from pending to processing/completed status with PayPal capture amounts significantly lower than the order total; multiple order-received requests for the same order ID with different token values.
• Application/Payment Records: PayPal transaction records showing a capture of a small amount (e.g., $0.01) while the corresponding WooCommerce order reflects a much higher total; PayPal order tokens appearing in WooCommerce orders they were not originally associated with.
• WooCommerce Order Notes: Order notes indicating PayPal payment captured successfully for an amount inconsistent with the order total (WPScan).

Update the "Subscriptions for WooCommerce" plugin to version 2.0.1 or later, which validates the captured PayPal amount against the WooCommerce order total and binds the PayPal token to the specific order. As an interim workaround, disable guest checkout in WooCommerce settings to require authentication before checkout, which raises the bar for exploitation. Additionally, review PayPal payment processing logs for orders where the captured amount does not match the order total, and consider temporarily disabling the WPS PayPal Payment gateway until the patch is applied (WPScan, Github Advisory).

The vulnerability was discovered and responsibly disclosed by researcher Pedro Pinho via WPScan. No significant vendor statements beyond the patch release or notable broader media coverage have been identified at this time.