WordPress SKT PayPal for WooCommerce plugin <= 1.4 - Unauthenticated Payment Bypass vulnerability

Unauthenticated Payment Bypass vulnerability discovered by ch4r0n - FPT Software in WordPress Plugin SKT PayPal for WooCommerce versions = 1.4...

CVE-2025-7820

CVE-2025-7820 : The SKT PayPal for WooCommerce WordPress plugin is vulnerable to unauthenticated payment bypass in all versions up to and including 1.4 due to relying on client-side (not server-side) payment controls. Wordfence reports a base score of 7.5 (HIGH) with network attack vector, low at...

CVE-2025-7820: Client-Side Enforcement of Server-Side Security

The SKT PayPal for WooCommerce plugin for WordPress is vulnerable to Payment Bypass in all versions up to, and including, 1.4. This is due to the plugin only enforcing client side controls instead of server-side controls when processing payments. This makes it possible for unauthenticated attacke...