CVE-2026-16990: 
WordPress vulnerability analysis and mitigation

CVE-2026-16990 is a payment price manipulation vulnerability in the Payment Button for PayPal WordPress plugin (slug: wp-paypal) affecting all versions through 1.2.3.44. The plugin fails to enforce merchant-configured prices server-side, instead trusting client-supplied payment amounts, enabling unauthenticated attackers to submit real PayPal orders at arbitrarily reduced prices. The vulnerability was added to WPScan on 2026-07-29, publicly disclosed on 2026-08-05, and published to NVD and the GitHub Advisory Database on 2026-08-12. It carries a CVSS v3.1 base score of 5.3 (Medium) (WPScan, GitHub Advisory).

The root cause is CWE-602: Client-Side Enforcement of Server-Side Security — the plugin delegates price validation to the client rather than verifying the payment amount on the server before creating a PayPal order. An attacker can intercept or craft the HTTP request that initiates a PayPal order and substitute an arbitrary lower amount in the client-supplied payment parameter. Because no authentication is required and the server accepts the tampered value without cross-checking it against the configured product price, the PayPal transaction is completed at the attacker-controlled amount. No special privileges or user interaction are needed, making the attack fully automatable (WPScan, GitHub Advisory).

Successful exploitation results in direct financial loss to the merchant: an attacker can purchase goods or services at a fraction of the intended price by submitting a legitimate PayPal transaction for an arbitrarily low amount (e.g., $0.01 instead of the configured price). There is no confidentiality or availability impact, but the integrity of the payment workflow is compromised. The impact is limited to the financial and transactional integrity of the affected WordPress store; no system-level compromise or data exfiltration is involved (WPScan, GitHub Advisory).

No public proof-of-concept exploit code is currently available; WPScan has indicated a PoC will be published on 2026-08-19 to allow time for users to update. There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is 0.0, reflecting low current exploitation probability. The attack is nonetheless highly automatable — requiring no authentication, no user interaction, and low complexity — making it a straightforward target once a PoC is released (WPScan, GitHub Advisory).

1. Reconnaissance: Identify WordPress sites using the wp-paypal plugin (Payment Button for PayPal) version ≤ 1.2.3.44 via passive scanning, Wappalyzer, or by checking /wp-content/plugins/wp-paypal/ for a readable readme.txt with version information.
2. Identify payment endpoint: Navigate to a page containing a PayPal payment button and use browser developer tools or a proxy (e.g., Burp Suite) to capture the HTTP request sent when initiating a PayPal order.
3. Tamper with the payment amount: Intercept the outgoing request and modify the client-supplied payment amount parameter to an arbitrarily low value (e.g., change amount=99.99 to amount=0.01).
4. Submit the tampered request: Forward the modified request to the server. Because the plugin does not validate the amount server-side, it passes the attacker-controlled value directly to the PayPal API.
5. Complete the transaction: PayPal processes the order at the attacker-specified amount, resulting in a completed, legitimate PayPal transaction for a fraction of the intended price, with the merchant receiving far less than the configured product price (WPScan).

• Logs: WordPress access logs showing repeated POST requests to PayPal order creation endpoints (e.g., wp-admin/admin-ajax.php or plugin-specific endpoints) with unusual or very low amount parameter values.
• PayPal Transaction Records: Completed PayPal orders in the merchant's PayPal dashboard with transaction amounts significantly below the configured product price (e.g., $0.01 transactions for products priced at $50+).
• Network: Multiple rapid order-creation requests from the same IP address or user agent, suggesting automated exploitation attempts.
• WordPress Logs: If query logging is enabled, entries showing payment initiation requests with client-supplied amount values that do not match any configured product price (WPScan).

Merchants should update the Payment Button for PayPal plugin to a version newer than 1.2.3.44 as soon as a patched release is available. As a workaround prior to patching, consider temporarily disabling the plugin or restricting access to payment pages to authenticated users only. Additionally, implement server-side validation of all payment amounts before processing PayPal orders to ensure the price cannot be modified by client-side requests. Monitor PayPal transaction records for anomalously low payment amounts as a detection measure (WPScan, GitHub Advisory).