CVE-2025-7820

The SKT PayPal for WooCommerce plugin for WordPress is vulnerable to Payment Bypass in all versions up to, and including, 1.4. This is due to the plugin only enforcing client side controls instead of server-side controls when processing payments. This makes it possible for unauthenticated attackers to make confirmed purchases without actually paying for them.

• CWE-602

• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3403118%40skt-paypal-for-woocommerce&new=3403118%40skt-paypal-for-woocommerce&sfp_email=&sfph_mail=
• https://www.wordfence.com/threat-intel/vulnerabilities/id/1a67b1b3-eb39-4e9a-ba44-ea637fc3bba1?source=cve

Published

Nov 27, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-7814A vulnerability classified as critical was found in code-pro…9.8
• CVE-2025-7815A vulnerability, which was classified as problematic, has be…5.4
• CVE-2025-7816A vulnerability, which was classified as problematic, was fo…5.4
• CVE-2025-7817A vulnerability has been found in PHPGurukul Apartment Visit…5.4
• CVE-2025-7818A vulnerability was found in PHPGurukul Apartment Visitors M…5.4
• CVE-2025-7819A vulnerability was found in PHPGurukul Apartment Visitors M…5.4
• CVE-2025-7821The WC Plus plugin for WordPress is vulnerable to unauthoriz…5.3
• CVE-2025-7822The WP Wallcreeper plugin for WordPress is vulnerable to una…4.3
• CVE-2025-7823A vulnerability was found in Jinher OA 1.2. It has been decl…9.8
• CVE-2025-7824A vulnerability was found in Jinher OA 1.1. It has been rate…9.8
• CVE-2025-7825The Schema Plugin For Divi, Gutenberg & Shortcodes plugin fo…6.3
• CVE-2025-7826The Testimonial plugin for WordPress is vulnerable to SQL In…6.5