{"id":"CVE-2026-16990","aliases":["EUVD-2026-57175","GHSA-4h7v-8qrm-x2jj"],"status":"published","title":"Payment Button for PayPal \u003c= 1.2.3.44 - Unauthenticated Payment Price Manipulation","description":"The Payment Button for PayPal WordPress plugin through 1.2.3.44 does not enforce the merchant-configured price server-side and trusts a client-supplied payment amount, allowing unauthenticated attackers to create a real PayPal order against the merchant for an arbitrary lower amount.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00324,"percentile":0.25785,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"published":"2026-08-12T11:24:00Z","modified":"2026-08-26T16:30:52Z","products":[{"vendor":"naa986","product":"payment button for paypal"},{"vendor":"unknown","product":"payment button for paypal"}],"references":[{"url":"https://wpscan.com/vulnerability/97c08603-c407-43b2-ab2c-e39f85e89ebe/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16990"},{"url":"https://wpscan.com/vulnerability/97c08603-c407-43b2-ab2c-e39f85e89ebe"},{"url":"https://github.com/advisories/GHSA-4h7v-8qrm-x2jj"}],"sources":{"cve":[{"id":"CVE-2026-16990","title":"Payment Button for PayPal \u003c= 1.2.3.44 - Unauthenticated Payment Price Manipulation","description":"The Payment Button for PayPal WordPress plugin through 1.2.3.44 does not enforce the merchant-configured price server-side and trusts a client-supplied payment amount, allowing unauthenticated attackers to create a real PayPal order against the merchant for an arbitrary lower amount.","status":"published","published":"2026-08-12T11:24:00.946Z","modified":"2026-08-12T12:10:20.775Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna"}],"updated_at":"2026-11-02T14:20:11.24076Z"}],"euvd":[{"id":"EUVD-2026-57175","description":"The Payment Button for PayPal WordPress plugin through 1.2.3.44 does not enforce the merchant-configured price server-side and trusts a client-supplied payment amount, allowing unauthenticated attackers to create a real PayPal order against the merchant for an arbitrary lower amount.","status":"published","published":"2026-08-12T11:24:00Z","modified":"2026-08-12T12:10:20Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T18:01:59.11112Z"}],"ghsa":[{"id":"GHSA-4h7v-8qrm-x2jj","title":"The Payment Button for PayPal WordPress plugin through 1.2.3.44 does not enforce the merchant...","description":"The Payment Button for PayPal WordPress plugin through 1.2.3.44 does not enforce the merchant-configured price server-side and trusts a client-supplied payment amount, allowing unauthenticated attackers to create a real PayPal order against the merchant for an arbitrary lower amount.","status":"published","published":"2026-08-12T12:32:54Z","modified":"2026-08-12T12:33:05Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:10:22.198935Z"}],"nvd":[{"id":"CVE-2026-16990","description":"The Payment Button for PayPal WordPress plugin through 1.2.3.44 does not enforce the merchant-configured price server-side and trusts a client-supplied payment amount, allowing unauthenticated attackers to create a real PayPal order against the merchant for an arbitrary lower amount.","status":"published","published":"2026-08-12T12:17:47.21Z","modified":"2026-08-26T16:30:52.723Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"}],"updated_at":"2026-11-02T14:12:36.880938Z"}]}}