EUVD-2026-124596

WooCommerce PayPal Pro Payment Gateway plugin before 4.1.1 contains an unauthenticated payment bypass vulnerability that allows remote attackers to mark unpaid orders as paid by exploiting the ppcaptureorder AJAX handler, which is gated only by a public checkout nonce and fails to properly valida...

CVE-2026-127204 WooCommerce PayPal Pro Payment Gateway < 4.1.1 Payment Bypass via pp_capture_order

WooCommerce PayPal Pro Payment Gateway plugin before 4.1.1 contains an unauthenticated payment bypass vulnerability that allows remote attackers to mark unpaid orders as paid by exploiting the ppcaptureorder AJAX handler, which is gated only by a public checkout nonce and fails to properly valida...

CVE-2026-127204

The WooCommerce PayPal Pro Payment Gateway plugin, in versions prior to 4.1.1 , is vulnerable to an unauthenticated payment bypass via the pp_capture_order AJAX handler. The flaw exists because the handler is only protected by a public checkout nonce and fails to properly validate the PayPal capt...