WordPress Subscriptions for WooCommerce plugin < 2.0.1 - Payment Bypass via Attacker-Supplied PayPal Capture Token vulnerability

Payment Bypass via Attacker-Supplied PayPal Capture Token vulnerability discovered by Pedro Pinho in WordPress Plugin Subscriptions for WooCommerce versions 2.0.1...

CVE-2026-15211 Subscriptions for WooCommerce < 2.0.1 - Payment Bypass via Attacker-Supplied PayPal Capture Token

The Subscriptions for WooCommerce WordPress plugin before 2.0.1 does not validate the payment amount or bind the PayPal order token to the order being completed on the WooCommerce order-received flow: it captures a client-supplied token and marks the order paid whenever the capture status is...