CVE-2026-92400

Summary

The flaw allows unauthenticated users to mark their own orders as paid by using a genuine transaction from a payment sandbox they control, bypassing order verification.

Exploitability

Exploitation requires access to a payment sandbox environment and knowledge of the plugin version. It is moderately difficult due to the need for sandbox control but feasible with proper setup.

Blast radius

If exploited, it could lead to unauthorized changes in user orders, potentially affecting financial records and customer trust.

Prioritized remediation

Update the Payment Gateway for PayPal on WooCommerce WordPress plugin to version 9.2.1 or later to ensure order verification is properly enforced.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.