CVE-2025-14463

The Payment Button for PayPal plugin for WordPress is vulnerable to unauthorized order creation in all versions up to, and including, 1.2.3.41. This is due to the plugin exposing a public AJAX endpoint (`wppaypalcheckout_ajax_process_order`) that processes checkout results without any authentication or server-side verification of the PayPal transaction. This makes it possible for unauthenticated attackers to create arbitrary orders on the site with any chosen transaction ID, payment status, product name, amount, or customer information via direct POST requests to the AJAX endpoint, granted they can bypass basic parameter validation. If email sending is enabled, the plugin will also trigger purchase receipt emails to any email address supplied in the request, leading to order database corruption and unauthorized outgoing emails without any real PayPal transaction taking place.

• CWE-862

• https://plugins.trac.wordpress.org/browser/wp-paypal/tags/1.2.3.41/wp-paypal-checkout.php#L249
• https://plugins.trac.wordpress.org/browser/wp-paypal/tags/1.2.3.41/wp-paypal.php#L70
• https://plugins.trac.wordpress.org/browser/wp-paypal/trunk/wp-paypal-checkout.php#L249
• https://plugins.trac.wordpress.org/browser/wp-paypal/trunk/wp-paypal.php#L70
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3431974%40wp-paypal&new=3431974%40wp-paypal&sfp_email=&sfph_mail=
• https://www.wordfence.com/threat-intel/vulnerabilities/id/814e50de-3690-4adf-bc01-a63cd71bd1cf?source=cve

Published

Jan 17, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-14457The Drag and Drop Multiple File Upload for Contact Form 7 pl…7.4
• CVE-2025-14459A flaw was found in KubeVirt Containerized Data Importer (CD…8.5
• CVE-2025-1446The Pods WordPress plugin before 3.2.8.2 does not sanitize …9.8
• CVE-2025-14460The Piraeus Bank WooCommerce Payment Gateway plugin for Word…5.3
• CVE-2025-14461The Xendit Payment plugin for WordPress is vulnerable to una…5.3
• CVE-2025-14462The Lucky Draw Contests plugin for WordPress is vulnerable t…4.3
• CVE-2025-14464The PDF Resume Parser plugin for WordPress is vulnerable to …5.3
• CVE-2025-14465The Sticky Action Buttons plugin for WordPress is vulnerable…4.3
• CVE-2025-14466A vulnerability in the web interface of the Güralp Fortimus …6.9
• CVE-2025-14467The WP Job Portal plugin for WordPress is vulnerable to Stor…4.4
• CVE-2025-14468The AMP for WP – Accelerated Mobile Pages plugin for WordPre…4.3
• CVE-2025-14469The Theme Editor plugin for WordPress is vulnerable to Cross…4.3