EUVD-2026-72785

XenForo before 2.3.13 contains a signature verification logic error in the PayPal REST webhook handler that allows unauthenticated attackers to bypass payment signature validation by submitting a webhook request with an unsupported authalgo header value. When the algorithm cannot be mapped to a...

CVE-2026-73314

XenForo before 2.3.13 contains a signature verification logic error in the PayPal REST webhook handler . When an unauthenticated attacker submits a webhook request with an unsupported auth_algo header value, the verification function incorrectly returns true instead of failing, causing the system...

CVE-2026-82304

Music Store is a WordPress eCommerce plugin that, in versions before 1.4.5 , is vulnerable to an unauthenticated SQL injection via the paypal-data handler. The root cause is unsanitised and unescaped user input passed directly into a SQL statement. The CVSS 3.1 base score is 8.6 (HIGH) , reflecti...

CVE-2026-82304 Music Store – WordPress eCommerce < 1.4.5 - Unauthenticated SQLi via paypal-data Handler

The Music Store WordPress plugin before 1.4.5 does not sanitise and escape user input before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users...

CVE-2026-82304 Music Store – WordPress eCommerce < 1.4.5 - Unauthenticated SQLi via paypal-data Handler

The Music Store WordPress plugin before 1.4.5 does not sanitise and escape user input before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users...

CVE-2026-84044

The Restaurant Menu and Food Ordering WordPress plugin before 2.4.12 does not verify that a PayPal payment notification genuinely originates from PayPal, allowing unauthenticated attackers to forge a payment notification and mark their own order as paid and completed without making any payment...

CVE-2026-84044

The Restaurant Menu and Food Ordering WordPress plugin before 2.4.12 fails to verify that a PayPal Instant Payment Notification (IPN) genuinely originates from PayPal. This allows unauthenticated attackers to forge a payment notification and mark their own order as paid and completed without maki...

CVE-2026-84044 Restaurant Menu and Food Ordering < 2.4.12 - Unauthenticated Payment Bypass via Forged PayPal IPN

The Restaurant Menu and Food Ordering WordPress plugin before 2.4.12 does not verify that a PayPal payment notification genuinely originates from PayPal, allowing unauthenticated attackers to forge a payment notification and mark their own order as paid and completed without making any payment...

EUVD-2026-70992

The Restaurant Menu and Food Ordering WordPress plugin before 2.4.12 does not verify that a PayPal payment notification genuinely originates from PayPal, allowing unauthenticated attackers to forge a payment notification and mark their own order as paid and completed without making any payment...

CVE-2026-77999

Joomla Extension - j2commerce.com - Unauthenticated PayPal callback forgery leading to order confirmation fraud in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6 - The PayPal IPN listener's signature check validateIPN accepted UNVERIFIED and any non-INVALID response as valid, made its verificati...

CVE-2026-77999 Joomla Extension - j2commerce.com - Unauthenticated PayPal callback forgery leading to order confirmation fraud in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6

Joomla Extension - j2commerce.com - Unauthenticated PayPal callback forgery leading to order confirmation fraud in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6 - The PayPal IPN listener's signature check validateIPN accepted UNVERIFIED and any non-INVALID response as valid, made its verificati...

CVE-2026-77999

J2Store (Joomla extension by j2commerce.com) versions 1.0.0–3.3.21, 4.0.0–4.0.21, and 4.1.0–4.1.6 contain an unauthenticated PayPal callback forgery vulnerability. The IPN listener's signature check (_validateIPN()) treated UNVERIFIED and any non-INVALID response as valid, issued verification wit...

EUVD-2026-70415

Joomla Extension - j2commerce.com - Unauthenticated PayPal callback forgery leading to order confirmation fraud in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6 - The PayPal IPN listener's signature check validateIPN accepted UNVERIFIED and any non-INVALID response as valid, made its verificati...

CVE-2026-73475

Incorrect Authorization vulnerability in Drupal Commerce PayPal allows Forceful Browsing. This issue affects Commerce PayPal versions: from 0.0.0 to 1.12.0, from 2.0.0 to 2.1.3...

CVE-2026-73475

CVE-2026-73475 is an Incorrect Authorization vulnerability in the Drupal Commerce PayPal module that allows Forceful Browsing . The module fails to sufficiently validate the transaction result when using the Payflow Link payment gateway, enabling a malicious user to mark transactions as completed...

CVE-2026-73475 Commerce PayPal - Moderately critical - Access bypass - SA-CONTRIB-2026-095

Incorrect Authorization vulnerability in Drupal Commerce PayPal allows Forceful Browsing. This issue affects Commerce PayPal versions: from 0.0.0 to 1.12.0, from 2.0.0 to 2.1.3...

EUVD-2026-69993

Incorrect Authorization vulnerability in Drupal Commerce PayPal allows Forceful Browsing. This issue affects Commerce PayPal versions: from 0.0.0 to 1.12.0, from 2.0.0 to 2.1.3...

CVE-2026-81026

MasterStudy LMS WordPress plugin versions prior to 3.7.40 contain an unauthenticated payment bypass via PayPal IPN (Instant Payment Notification). The plugin fails to verify the amount, receiver, currency, or status of an incoming payment notification before marking the corresponding order as com...

CVE-2026-81026 MasterStudy LMS < 3.7.40 - Unauthenticated Payment Bypass via PayPal IPN

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.40 does not verify the amount, receiver, currency or status of a payment notification before marking the corresponding order completed, allowing unauthenticated users to complete full-price orders and gain access to paid content by...

CVE-2026-76586

The Appointment Booking Calendar Plugin and Scheduling Plugin (also known as BookingPress ) for WordPress, versions 1.5.6 through 1.6.2 , contains a payment validation flaw. When confirming an online PayPal payment, the plugin does not verify the amount actually paid against the server-side price...