CVE-2026-17008: 
WordPress vulnerability analysis and mitigation

CVE-2026-17008 is an unauthenticated payment bypass vulnerability in the Quick Paypal Payments WordPress plugin (by Fullworks) affecting all versions through 5.7.50. The flaw allows any buyer to have a full-price order marked as paid by submitting an arbitrarily small payment amount, due to insufficient validation in the plugin's PayPal IPN handler. It was publicly disclosed on August 5, 2026, and added to the GitHub Advisory Database on August 12, 2026. The vulnerability carries a CVSS v3.1 base score of 5.3 (Medium) (WPScan, Github Advisory).

The root cause is insufficient verification of data authenticity (CWE-345) in the plugin's PayPal Instant Payment Notification (IPN) handler. When a payment notification is received, the handler only checks whether the order token matches an existing order, without validating the paid amount, the payment receiver, or the payment status returned by PayPal. An unauthenticated remote attacker can craft or manipulate an IPN callback — paying a trivially small amount (e.g., $0.01) — and the plugin will mark the corresponding full-price order as paid upon token match. No privileges or user interaction are required to exploit this flaw (WPScan, Github Advisory).

Successful exploitation allows an attacker to fraudulently complete purchases without paying the full price, causing direct financial loss to the merchant. The integrity of the order management system is compromised, as orders are incorrectly marked as paid. There is no confidentiality or availability impact; the vulnerability is limited to integrity tampering affecting the payment workflow (WPScan, Github Advisory).

No public proof-of-concept exploit is currently available; WPScan has indicated a PoC will be published on August 19, 2026, to allow time for users to update. There is no evidence of in-the-wild exploitation at this time. The EPSS score is 0.0, and the vulnerability is not listed in the CISA KEV catalog. However, the attack is rated as automatable (no privileges or user interaction required), making it straightforward to exploit at scale once a PoC is released (WPScan, Github Advisory).

1. Reconnaissance: Identify WordPress sites using the Quick Paypal Payments plugin (versions ≤ 5.7.50) by scanning for plugin-specific files (e.g., /wp-content/plugins/quick-paypal-payments/) or using tools like WPScan.
2. Initiate a legitimate order: Place an order on the target site using the Quick Paypal Payments checkout flow to obtain a valid order token.
3. Intercept or observe the IPN callback URL: Note the PayPal IPN endpoint used by the plugin (typically a WordPress admin-ajax or custom handler URL) and the order token associated with the order.
4. Submit a minimal payment via PayPal: Complete a PayPal payment for an arbitrarily small amount (e.g., $0.01) referencing the same order token, or craft a spoofed IPN POST request to the plugin's IPN handler endpoint containing the valid order token, a minimal payment amount, and a 'Completed' payment status.
5. Order marked as paid: The plugin matches the order token and marks the full-price order as paid without verifying the amount, receiver, or payment status, granting the attacker the purchased goods or services (WPScan).

• Logs: WordPress access logs showing unexpected POST requests to the PayPal IPN handler endpoint (e.g., /?wc-api= or plugin-specific IPN URL) from IP addresses not associated with PayPal's known IP ranges.
• Database: Orders in the WordPress database marked as 'paid' or 'completed' with payment amounts significantly lower than the order total, or with mismatched receiver email addresses.
• Network: Inbound IPN POST requests originating from non-PayPal IP addresses or with unusual payment_status, mc_gross, or receiver_email field values.
• Application: Multiple orders completed in rapid succession from the same IP or user account with minimal payment amounts recorded.

At the time of disclosure, no patched version of the Quick Paypal Payments plugin is available for versions through 5.7.50. Site administrators should monitor for a plugin update from Fullworks and apply it immediately upon release. As a workaround, implement additional server-side validation to verify that PayPal IPN notifications include the correct payment amount, receiver email, and a 'Completed' payment status before marking any order as paid. Alternatively, consider temporarily disabling the plugin or switching to a payment solution with robust IPN validation until a fix is available (WPScan, Github Advisory).

The vulnerability was discovered and submitted by researcher Muni Nitish Kumar Yaddala and verified by WPScan. WPScan has deliberately delayed publishing the proof-of-concept until August 19, 2026, to give site operators time to update, reflecting responsible disclosure practices. No significant broader media coverage or notable social media commentary has been observed at this time (WPScan).