Answer in brief
CVE-2026-127204 records a High severity (CVSS 8.7) vulnerability in WooCommerce PayPal Pro Payment Gateway < 4.1.1 Payment Bypass via pp_capture_order. The current sources do not mark it as known exploited. The current feed maps wp.insider/Payment Gateway for PayPal Pro, PayPal Checkout & Subscriptions for WooCommerce (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 8.7. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps wp.insider/Payment Gateway for PayPal Pro, PayPal Checkout & Subscriptions for WooCommerce (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| wp.insider/Payment Gateway for PayPal Pro, PayPal Checkout & Subscriptions for WooCommercegeneric | >=0 <4.1.1 | 4.1.1 |
Published upstream
Nov 12, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Nov 12, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Nov 12, 2026
WooCommerce PayPal Pro Payment Gateway plugin before 4.1.1 contains an unauthenticated payment bypass vulnerability that allows remote attackers to mark unpaid orders as paid by exploiting the pp_capture_order AJAX handler, which is gated only by a public checkout nonce and fails to properly validate the PayPal capture response status. Attackers can supply a valid _paypal_order_id to trigger payment_complete() without verifying the capture status or amount, causing the store to fulfill goods or services that were never paid for and resulting in direct financial loss to the merchant.
Quoted source text, attributed separately from HOL analysis.