Summary
CVE-2026-59547 is a high-severity Broken Access Control vulnerability (CVSS 7.5) affecting the Payment Gateway for PayPal on WooCommerce plugin (slug: woo-paypal-gateway) by Easy Payment, in all versions up to and including 9.1.4. The flaw stems from a missing authorization and nonce token check in a payment-handling function, enabling unauthenticated, network-based attackers to complete a WooCommerce checkout using a different — for example, lower-value — PayPal payment than the actual order amount. A patched version (9.1.5) was released on July 20, 2026.
Technical details
- Root cause: A payment-processing function lacks the required authorization, authentication, or nonce token validation, allowing unprivileged users to invoke privileged payment operations without any credentials.
- Trigger conditions: No authentication or user interaction is required. An attacker with network access to the target store can trigger the vulnerable endpoint directly.
- Attack vector: Network-accessible; exploitable by any unauthenticated remote actor. Attack complexity is low — no special conditions or configurations are required.
- Impact: An attacker can submit a PayPal payment authorization for an amount lower than the actual WooCommerce order total, then exploit the missing reconciliation check to have that lower-value payment accepted as fulfillment of the higher-value order. The order ID, amount, and currency embedded in the PayPal payment were not validated against the WooCommerce order prior to payment capture, enabling checkout completion with a mismatched payment. The fix in version 9.1.5 explicitly addresses this by reconciling the approved PayPal order against the WooCommerce order — including order ID, amount, and currency — before any payment is captured.
Affected software
- Payment Gateway for PayPal on WooCommerce (plugin slug:
woo-paypal-gateway) by Easy Payment — all versions ≤ 9.1.4
Severity
- CVSS v3.1 Base Score: 7.5 (High)
- Vector String:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Mitigation and recommended actions
- Immediate action: Update the plugin to version 9.1.5 or later (current latest: 9.2.0, released July 22, 2026). The patch is available directly from the WordPress plugin repository.
- If an immediate update is not possible, consider temporarily disabling the plugin and using an alternative payment method until the update can be applied.
- Review WooCommerce order logs for any orders where the PayPal payment amount does not match the recorded order total, as this could indicate prior exploitation attempts.
IONIX Status
The IONIX research team is tracking ongoing exploitation attempts and recommends immediate patching. Potentially affected assets are outlined in this post.