CVE-2026-92400

MediumCVSS 5.3/10Last modified Sep 22, 2026

Description

The Payment Gateway for PayPal on WooCommerce WordPress plugin before 9.2.1 does not verify that an incoming payment notification was confirmed in the store's configured payment environment or paid to the store's own merchant account before marking an order complete, allowing unauthenticated users to mark their own orders as paid using a genuine transaction from a payment sandbox they control.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-345

Affected software

Vendor	Product	Versions
Unknown	Payment Gateway for PayPal on WooCommerce	< 9.2.1

References

https://wpscan.com/vulnerability/3dcee743-a95d-4233-b78e-8449a6cc8aea/

Timeline

Published: Sep 21, 2026
Last modified: Sep 22, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-924017.3A vulnerability was identified in ChangeWeDer crm up to c07bd4c97141521af6475034bc58523beed51bbd. This vulnerability affects the function to CVE-2026-924026.3A security flaw has been discovered in ChangeWeDer crm up to c07bd4c97141521af6475034bc58523beed51bbd. This issue affects the function index CVE-2026-924033.7The Secure Custom Fields WordPress plugin before 6.9.4 does not properly verify that a front-end form submission corresponds to the form tha CVE-2026-924047.5The MgoSync WordPress plugin before 2.1.7 does not have authorization controls on one of its REST API endpoints, allowing unauthenticated u CVE-2026-924057.3A security vulnerability has been detected in SourceCodester Inventory and Monitoring System 1.0. The affected element is an unknown functio CVE-2026-924067.3A vulnerability was detected in SourceCodester Inventory and Monitoring System 1.0. The impacted element is an unknown function of the file CVE-2026-924085.3The WPS Bookings for WooCommerce WordPress plugin before 3.13.1 does not validate a price value taken from user input before using it to set CVE-2026-924096.8The Donation Thermometer WordPress plugin before 2.3.0 does not escape a colour value taken from a shortcode attribute before using it in an CVE-2026-92414.3The FOX – Currency Switcher Professional for WooCommerce plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled CVE-2026-924104.3The Sign-up Sheets WordPress plugin before 2.4.0 does not properly validate the CSRF nonce that protects its sign-up deletion action, allowi CVE-2026-924116.8The WP Delicious WordPress plugin before 1.10.8 does not validate or escape the HTML tag name taken from user-supplied recipe block data be CVE-2026-924127.1The Five Star Restaurant Reviews WordPress plugin before 2.3.14 does not properly escape a user-supplied value before outputting it into an