blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2026-92400

MEDIUM 5.3 CVSS 3.1
Published
September 21, 2026
Last modified
September 22, 2026
NVD status
Deferred
Reported by
contact@wpscan.com
Weakness
CWE-345
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Description

The Payment Gateway for PayPal on WooCommerce WordPress plugin before 9.2.1 does not verify that an incoming payment notification was confirmed in the store's configured payment environment or paid to the store's own merchant account before marking an order complete, allowing unauthenticated users to mark their own orders as paid using a genuine transaction from a payment sandbox they control.

Affected WordPress components

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

  • Unknown Payment Gateway for PayPal on WooCommerce — Before 9.2.1

References

  • wpscan.com https://wpscan.com/vulnerability/3dcee743-a95d-4233-b78e-8449a6cc8aea/
  • nvd.nist.gov Official NVD record