CVE-2026-15211

The Subscriptions for WooCommerce WordPress plugin before 2.0.1 does not validate the payment amount or bind the PayPal order token to the order being completed on the WooCommerce order-received flow: it captures a client-supplied token and marks the order paid whenever the capture status is...

CVE-2026-15211 Subscriptions for WooCommerce < 2.0.1 - Payment Bypass via Attacker-Supplied PayPal Capture Token

The Subscriptions for WooCommerce WordPress plugin before 2.0.1 does not validate the payment amount or bind the PayPal order token to the order being completed on the WooCommerce order-received flow: it captures a client-supplied token and marks the order paid whenever the capture status is...

CVE-2026-15211

The Subscriptions for WooCommerce WordPress plugin before 2.0.1 does not validate the payment amount or bind the PayPal order token to the order being completed on the WooCommerce order-received flow: it captures a client-supplied token and marks the order paid whenever the capture status is...

CVE-2026-47127: Missing Authorization

Ghostfolio is an open source wealth management software. Prior to version 3.4.0, Ghostfolio's Stripe checkout success-URL handler at GET /api/v1/subscription/stripe/callback?checkoutSessionId= retrieves the Stripe Checkout Session by ID and unconditionally grants a Premium subscription to the...

MAL-2026-13391 Malicious code in @zahlen/checkout (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4d1a20d08b428711d9b8c349d981cf4997f086b8cbd8dce407ef26e02706f33e No a static rule or traced code paths flagged malicious behavior in this package. No lifecycle hooks fetching or executing remote content, no...

Malicious code in @voxepay/checkout (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0ce33339fdc1c4c994f6062588e4f4278ee9074ddb04759504100e89084f4a96 No suspicious behaviors were identified in this package version. There are no install-time lifecycle scripts performing remote fetches, no hardcoded...

Malicious code in @zahlen/checkout (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4d1a20d08b428711d9b8c349d981cf4997f086b8cbd8dce407ef26e02706f33e No a static rule or traced code paths flagged malicious behavior in this package. No lifecycle hooks fetching or executing remote content, no...

MAL-2026-13389 Malicious code in @voxepay/checkout (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0ce33339fdc1c4c994f6062588e4f4278ee9074ddb04759504100e89084f4a96 No suspicious behaviors were identified in this package version. There are no install-time lifecycle scripts performing remote fetches, no hardcoded...

MAL-2026-13388 Malicious code in @simplipayng/checkout (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 00ead1207956df050d2746ae899d5ea9132fbc4c35684f9e992599c5ef10259c The bundled main dist/index.js executes an evalatob... blob at module top level, so any Node-side require of the package SSR, tests, Next.js server...

EUVD-2026-53729

The Checkimate — WooCommerce Checkout, Abandoned Cart Recovery & Order Bumps WordPress plugin through 1.0.13 does not properly restrict access to its license-management functionality, relying on a shared secret computed entirely from publicly available information, allowing unauthenticated...

PT-2026-68395

Name of the Vulnerable Software and Affected Versions Checkimate — WooCommerce Checkout, Abandoned Cart Recovery & Order Bumps WordPress plugin versions prior to 1.0.14 Description Insufficient access restrictions in the license-management functionality allow unauthenticated attackers to deactiva...

CVE-2026-14829: Improper Access Control

The Checkimate — WooCommerce Checkout, Abandoned Cart Recovery & Order Bumps WordPress plugin through 1.0.13 does not properly restrict access to its license-management functionality, relying on a shared secret computed entirely from publicly available information, allowing unauthenticated...

Malicious Package

Overview @voxepay/checkout is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview @zahlen/checkout is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview @simplipayng/checkout is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in checkout-base-analytics-data (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a6130d2e85aedac754a5a7f0d31a255c2f45d702484e6a81df50ca4c326395aa On require of the package's main index.js, the hidden polyfill.js runs a bootstrap routine that selects a platform-specific asset path, fetches an...

MAL-2026-12543 Malicious code in checkout-base-analytics-data (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a6130d2e85aedac754a5a7f0d31a255c2f45d702484e6a81df50ca4c326395aa On require of the package's main index.js, the hidden polyfill.js runs a bootstrap routine that selects a platform-specific asset path, fetches an...

MAL-2026-12551 Malicious code in checkout-create-draft-agreement-am (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 10d5b346e136a72594ca30d1e1d508bb152b82d20d8beb1d14bf126dd78b9977 On require of checkout-create-draft-agreement-am, index.js loads polyfill.js which downloads a platform-specific native binary from Cloudflare Worker...

MAL-2026-12546 Malicious code in checkout-cashback-logic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 493f562fef163499ed128f94b588b857aa8016e563a6291459cfe79f0c8571b3 [email protected] silently requires bootstrap.js when the package is loaded. The bootstrap script assembles Cloudflare Workers subdomain...

Malicious code in checkout-cashback-logic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 493f562fef163499ed128f94b588b857aa8016e563a6291459cfe79f0c8571b3 [email protected] silently requires bootstrap.js when the package is loaded. The bootstrap script assembles Cloudflare Workers subdomain...