WooCommerce PayPal Pro Payment Gateway: payment bypass (CVE-2026-127204)
A vulnerability, CVE-2026-127204 (CVSS 8.7), was reported in the WooCommerce PayPal Pro Payment Gateway plugin. The pp_capture_order AJAX handler is gated only by a public checkout nonce and does not validate the status or amount of the PayPal capture response.
Checked in Shield: no
Who is affected
WooCommerce stores running WooCommerce PayPal Pro Payment Gateway before version 4.1.1. The attack is remote and unauthenticated: an unpaid order can be marked as paid.
How to check
In the WordPress admin, open Plugins and find WooCommerce PayPal Pro Payment Gateway. If the version is below 4.1.1, the plugin is vulnerable.
How to fix
A fix is available: update the plugin to version 4.1.1 or later.
What Shield checks not checked
Checked in Shield: no. This is usually not visible from outside, or the check has not been added yet; we collect such cases and add checks in batches.
Good to know
The source (NVD) does not say whether the issue is exploited in the wild; this is not disclosed yet.
