CVE-2026-127204

WooCommerce PayPal Pro Payment Gateway plugin before 4.1.1 contains an unauthenticated payment bypass vulnerability that allows remote attackers to mark unpaid orders as paid by exploiting the ppcaptureorder AJAX handler, which is gated only by a public checkout nonce and fails to properly valida...