PatchSiren cyber security CVE debrief
CVE-2026-9284 woocommerce CVE debrief
The WooCommerce PayPal Payments plugin for WordPress contains missing authorization checks on two WC-AJAX endpoints (`ppc-create-order` and `ppc-get-order`) in versions up to and including 4.0.1. The `ppc-create-order` endpoint accepts arbitrary WooCommerce order IDs in the `pay-now` context without validating order ownership, allowing unauthenticated attackers to create PayPal orders for any WC order and write PayPal metadata to it. The `ppc-get-order` endpoint returns full PayPal order details for any PayPal order ID without session binding. These vulnerabilities can be chained to manipulate other customers' order payment flows and exfiltrate sensitive order details including payer information and shipping data.
- Vendor
- woocommerce
- Product
- WooCommerce PayPal Payments
- CVSS
- HIGH 8.2
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-05-23
- Original CVE updated
- 2026-05-26
- Advisory published
- 2026-05-23
- Advisory updated
- 2026-05-26
Who should care
E-commerce operators using WooCommerce PayPal Payments plugin versions ≤4.0.1; WordPress security administrators; payment compliance teams monitoring for unauthorized order access or PII exposure
Technical summary
The vulnerability stems from two distinct missing authorization weaknesses in WC-AJAX endpoints. The `ppc-create-order` endpoint fails to validate that the requesting user owns the WooCommerce order ID provided in the `pay-now` context, allowing arbitrary order ID submission. The `ppc-get-order` endpoint lacks session binding when retrieving PayPal order details, permitting retrieval of any PayPal order by ID alone. Chaining these endpoints enables an attacker to: (1) create a PayPal order for a victim's WooCommerce order via `ppc-create-order`, and (2) retrieve the resulting PayPal order details via `ppc-get-order`, exposing sensitive payer and shipping information while potentially disrupting legitimate payment flows.
Defensive priority
HIGH
Recommended defensive actions
- Upgrade WooCommerce PayPal Payments plugin to version 4.0.2 or later
- Review PayPal order metadata for unauthorized modifications on affected sites
- Implement Web Application Firewall rules to restrict access to `ppc-create-order` and `ppc-get-order` endpoints if immediate patching is not possible
- Audit WooCommerce orders for unexpected PayPal order associations
- Monitor for anomalous access patterns to WC-AJAX endpoints
Evidence notes
Vulnerability disclosed by Wordfence. Source code references confirm missing authorization checks in CreateOrderEndpoint.php (line 249) and GetOrderEndpoint.php (line 44). Changeset reference indicates patch availability.
Official resources
2026-05-23