Vulnerability in Payment Gateway for PayPal on WooCommerce — CVE-2026-92400

What to do now

Update Payment Gateway for PayPal on WooCommerce to 9.2.1 or later.

Affected versions

• Everything before 9.2.1

The Payment Gateway for PayPal on WooCommerce WordPress plugin before 9.2.1 does not verify that an incoming payment notification was confirmed in the store's configured payment environment or paid to the store's own merchant account before marking an order complete, allowing unauthenticated users to mark their own orders as paid using a genuine transaction from a payment sandbox they control.

This description is reproduced verbatim from the public vulnerability record.

• https://wpscan.com/vulnerability/3dcee743-a95d-4233-b78e-8449a6cc8aea/

This page is compiled automatically from public databases. Accuracy is not guaranteed; confirm against the vendor advisory before acting.