PatchSiren cyber security CVE debrief

CVE-2026-9284 woocommerce CVE debrief

The WooCommerce PayPal Payments plugin for WordPress contains missing authorization checks on two WC-AJAX endpoints (`ppc-create-order` and `ppc-get-order`) in versions up to and including 4.0.1. The `ppc-create-order` endpoint accepts arbitrary WooCommerce order IDs in the `pay-now` context without validating order ownership, allowing unauthenticated attackers to create PayPal orders for any WC order and write PayPal metadata to it. The `ppc-get-order` endpoint returns full PayPal order details for any PayPal order ID without session binding. These vulnerabilities can be chained to manipulate other customers' order payment flows and exfiltrate sensitive order details including payer information and shipping data.

Vendor: woocommerce
Product: WooCommerce PayPal Payments
CVSS: HIGH 8.2
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-05-23
Original CVE updated: 2026-07-23
Advisory published: 2026-05-23
Advisory updated: 2026-07-23

Who should care

E-commerce operators using WooCommerce PayPal Payments plugin versions ≤4.0.1; WordPress security administrators; payment compliance teams monitoring for unauthorized order access or PII exposure

Technical summary

The vulnerability stems from two distinct missing authorization weaknesses in WC-AJAX endpoints. The `ppc-create-order` endpoint fails to validate that the requesting user owns the WooCommerce order ID provided in the `pay-now` context, allowing arbitrary order ID submission. The `ppc-get-order` endpoint lacks session binding when retrieving PayPal order details, permitting retrieval of any PayPal order by ID alone. Chaining these endpoints enables an attacker to: (1) create a PayPal order for a victim's WooCommerce order via `ppc-create-order`, and (2) retrieve the resulting PayPal order details via `ppc-get-order`, exposing sensitive payer and shipping information while potentially disrupting legitimate payment flows.

Defensive priority

HIGH

Recommended defensive actions

Upgrade WooCommerce PayPal Payments plugin to version 4.0.2 or later
Review PayPal order metadata for unauthorized modifications on affected sites
Implement Web Application Firewall rules to restrict access to `ppc-create-order` and `ppc-get-order` endpoints if immediate patching is not possible
Audit WooCommerce orders for unexpected PayPal order associations
Monitor for anomalous access patterns to WC-AJAX endpoints

Evidence notes

Vulnerability disclosed by Wordfence. Source code references confirm missing authorization checks in CreateOrderEndpoint.php (line 249) and GetOrderEndpoint.php (line 44). Changeset reference indicates patch availability.

Sources and references

Verified primary and authoritative sources

CVE-2026-9284 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2026-9284

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2026-9284 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2026-9284

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Source reference
Unverified legacy reference

URL: https://plugins.trac.wordpress.org/browser/woocommerce-paypal-payments/tags/3.3.2/modules/ppcp-button/src/Endpoint/CreateOrderEndpoint.php

[email protected]
Source reference
Unverified legacy reference

URL: https://plugins.trac.wordpress.org/browser/woocommerce-paypal-payments/tags/3.3.2/modules/ppcp-button/src/Endpoint/GetOrderEndpoint.php

[email protected]
Source reference
Unverified legacy reference

URL: https://plugins.trac.wordpress.org/browser/woocommerce-paypal-payments/trunk/modules/ppcp-button/src/Endpoint/CreateOrderEndpoint.php

[email protected]
Source reference
Unverified legacy reference

URL: https://plugins.trac.wordpress.org/browser/woocommerce-paypal-payments/trunk/modules/ppcp-button/src/Endpoint/GetOrderEndpoint.php

[email protected]

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.