CVE-2026-127204 | WooCommerce Payment Gateway for PayPal Pro up to 4.1.0 AJAX payment_complete _paypal_order_id authorization

November 12, 2026 Yanac

A vulnerability classified as problematic was found in WooCommerce Payment Gateway for PayPal Pro and PayPal Checkout & Subscriptions Plugin up to 4.1.0. The affected element is the function payment_complete of the component AJAX Handler. The manipulation of the argument _paypal_order_id results in missing authorization.

This vulnerability is cataloged as CVE-2026-127204. The attack may be launched remotely. There is no exploit available.

Upgrading the affected component is advised.VulDB Recent EntriesRead More