CVE-2026-17008
Quick PayPal Payments <= 5.7.50 - Unauthenticated Payment Bypass via PayPal IPN
- State
- Published
- Severity
- 5.3 Medium
- Published
- Aug 12, 2026
- Updated
- Aug 12, 2026
- Reserved
- Jul 24, 2026
Description
The Quick Paypal Payments WordPress plugin through 5.7.50 does not verify the paid amount, receiver, or payment status in its PayPal IPN handler and marks an order paid on an order-token match alone, so a buyer who pays an arbitrary small amount can have a full-price order marked paid.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 5.3 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N | WPScan |
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
Quick Paypal PaymentsUnknown |
|
References
- https://wpscan.com/vulnerability/605c0c65-6258-411a-a028-f3de25613bdf/exploitvdb-entrytechnical-description
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.