CVE-2026-15211

Executive Summary

CVE-2026-15211 is a payment bypass vulnerability in the Subscriptions for WooCommerce WordPress plugin (versions prior to 2.0.1). The flaw allows an unauthenticated attacker to manipulate the WooCommerce order-received flow by supplying a crafted PayPal capture token, causing an order to be marked as paid without the corresponding payment being captured. This vulnerability has a CVSS score of 5.9 (Medium severity), and a public PoC exists, although no exploit code or Nuclei template has been released. Affected systems include all WooCommerce stores using the plugin before version 2.0.1 where guest checkout is enabled, with the primary impact being denial of service to the merchant through fraudulent orders and revenue loss.

Technical Analysis

The vulnerability resides in the payment completion logic of the Subscriptions for WooCommerce plugin, specifically in the PayPal payment gateway integration. The plugin handles the order-received endpoint (typically /?wc-ajax=update_order_review or /checkout/order-received/{order_id}/) and processes PayPal callback data to finalize orders.

The root cause is a failure in two critical validation checks:

1. Missing Amount Validation: The plugin does not compare the captured payment amount (from the PayPal API response) against the order total stored in the WooCommerce database. An attacker can initiate a payment for a low-cost item (e.g., $0.01) or a fully approved but uncharged order, and then substitute that order's PayPal capture token into a request for an expensive target order.

2. Missing Token Binding: The PayPal order token (the token or paypal_order_id parameter) is not cryptographically bound to the specific WooCommerce order being completed. The plugin accepts a client-supplied token without verifying that the token corresponds to the order ID in the request URI/session.

The attack flow at the code level:

• The plugin registers a webhook/API handler that reads $_POST/$_GET parameters including order_id, token, and capture_status.
• It initializes the PayPal API client using the attacker-supplied token.
• It calls PayPal\Api\Payment::get($token, $apiContext) and checks $payment->getState() === 'approved' or similar.
• If approved, it calls $payment->execute() or reads $payment->getTransactions()[0]->getAmount().
• The plugin then unconditionally calls $order->payment_complete($transaction_id) without cross-checking:
  • That $payment->getTransactions()[0]->getAmount()->getTotal() equals $order->get_total().
  • That the PayPal payment is associated with the $order_id in the request.

This is classified under CWE-345 (Insufficient Verification of Data Authenticity).

The attack surface is the WooCommerce front-end checkout endpoint, which is publicly accessible. Guest checkout is a prerequisite, as it allows an attacker to avoid creating an account that could be traced. Authentication is not required.

Exploitation Scenarios

The following is a concrete, step-by-step attack chain exploiting this vulnerability:

Step 1 — Reconnaissance / Target Identification:

• The attacker discovers a WooCommerce store running the vulnerable plugin. This can be done via plugin fingerprinting (e.g., checking for /wp-content/plugins/subscriptions-for-woocommerce/readme.txt or detecting the plugin's JavaScript assets).
• The attacker browses the store catalog and identifies two items:
  • Target: An expensive product (e.g., an annual subscription worth $999.00).
  • Decoy: The cheapest product available (e.g., a $1.00 add-on).

Step 2 — Decoy Order Creation & Approval:

• The attacker adds the decoy product to the cart and proceeds to checkout as a guest, selecting PayPal as the payment method.
• The attacker completes the PayPal flow up to the approval step but does NOT complete the payment (i.e., they stop on the PayPal approval page or cancel after approval). This generates a valid PayPal order token (e.g., PAYID-XXXXXX) with an approved status but a zero/incomplete capture.
• The attacker captures the exact token, PayerID, and other PayPal callback query parameters from the browser's redirect URL (e.g., ?token=PAYID-XXXXXX&PayerID=ABCDEF&paymentId=...).

Step 3 — Target Order Manipulation:

• The attacker adds the expensive subscription product to the cart and proceeds to checkout as a guest, again selecting PayPal. They do NOT pay; instead, they note the WooCommerce order ID (e.g., order_id=45231) from the checkout URL or session.
• Alternatively, the attacker can create the expensive order and leave it in "pending payment" status without even navigating to PayPal (WooCommerce typically generates the order at checkout page load).

Step 4 — Payload / Exploit Execution:

• The attacker sends a crafted HTTP request to the vulnerable endpoint:

  GET /checkout/order-received/45231/?token=PAYID-XXXXXX&PayerID=ABCDEF&paymentId=PAYID-XXXXXX HTTP/1.1
  Host: victim-store.com
  Cookie: woocommerce_cart_hash=...; woocommerce_items_in_cart=...
  

• The plugin receives order ID 45231, reads the attacker-supplied token parameter (PAYID-XXXXXX from the decoy $1 order), queries PayPal for that token, and receives a "COMPLETED" capture status.
• The plugin calls $order->payment_complete($paymentId) on order 45231, marking the $999 subscription as fully paid, without ever checking the amount.

Step 5 — Post-Exploitation Impact:

• The attacker now has an active $999/annual subscription activated on their account (or guest email), which they can use to download digital goods, access premium content, or resell access.
• The store's revenue ledger shows a completed $999 sale, but the merchant never receives the funds.
• A batch attack can be conducted: create hundreds of decoy low-value orders, generate hundreds of approved tokens (no cost to the attacker), and then submit them against hundreds of expensive order IDs across multiple accounts in minutes.

Optionally, the attacker can use the PayerID to trick PayPal's IPN notification and send a "payment completed" callback to the store for the decoy amount, further confusing reconciliation.

Impact Assessment

Confidentiality Impact: None (C: N) Integrity Impact: High (I: H) — order payment status is forged. Availability Impact: None (A: N)

The CVSS vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N reflects high attack complexity (attacker needs to orchestrate the PayPal token flow) but no privileges and no user interaction.

Business Impact:

• Direct revenue loss: subscribers receive premium services without paying.
• Financial reconciliation disruption: WooCommerce reports show falsely captured transactions.
• Chargeback and fraud flags: PayPal may flag the merchant account for unusual activity, potentially freezing funds.
• Subscription integrity: if the store sells access to proprietary APIs, SaaS features, or downloadable code, the attacker gains unauthorized access to premium content.
• Legal/compliance: if the subscription unlocks regulated data (e.g., financial reports, medical content), a breach may trigger disclosure obligations.

Affected Systems: Any WooCommerce store using "Subscriptions for WooCommerce" version < 2.0.1 with PayPal as an enabled payment method and guest checkout enabled. Internal-only stores (no guest checkout, registration required) are less exposed but still vulnerable if an attacker registers an account.

Blast Radius: The exploit is a payment bypass; it does not provide RCE, data exfiltration, or lateral movement. The blast radius is confined to the store's order processing pipeline.

Detection Guidance

Sigma Rule

title: WooCommerce Subscriptions Payment Bypass - Order-Received Token Manipulation
id: 3a9f1f3e-8c21-4b9d-a2f4-1d0b6a77be01
status: experimental
description: Detects HTTP requests to WooCommerce order-received endpoints where the PayPal token is reused across different order IDs or the order status changes rapidly from pending to paid without a corresponding PayPal IPN.
author: Valters IT Security
date: 2026/02/15
logsource:
  category: webserver
  product: apache
  service: accesslog
detection:
  selection_token_in_order_url:
    cs-method: GET
    c-uri|contains:
      - '/checkout/order-received/'
    c-uri|contains|all:
      - 'token='
      - 'PayerID='
  selection_rapid_status_change:
    # This is a secondary log source (WooCommerce order notes / audit logs)
    cs-method: POST
    c-uri|contains: '/wp-json/wc/v3/orders/'
  filter_known_good:
    c-uri|contains:
      - 'key=wc_order_'  # Legitimate order-keyed confirmation URLs
  condition: selection_token_in_order_url and not filter_known_good
  timeframe: 10m
level: high
falsepositives:
  - Legitimate PayPal redirects after a real payment where the user returns to the site.
fields:
  - src_ip
  - c-uri
  - user-agent

YARA Rule

rule WooCommerce_Subscriptions_Payment_Bypass
{
    meta:
        author = "Valters IT Security"
        description = "Detects traffic or files containing suspicious PayPal token injection payloads targeting WooCommerce order-received endpoints."
        cve = "CVE-2026-15211"
        date = "2026-02-15"
        score = 60

    strings:
        $a = "/checkout/order-received/" ascii wide nocase
        $b = "token=PAYID-" ascii wide nocase
        $c = "PayerID=" ascii wide nocase
        $d = "order-received" ascii wide nocase
        $e = "paymentId=" ascii wide nocase

    condition:
        all of them and #b > 5  // Heuristic: many token parameters in one payload
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2026-15211 - WooCommerce Subscriptions Payment Bypass - Suspicious PayPal Token in Order-Received URL"; flow:to_server,established; content:"GET"; http_method; content:"/checkout/order-received/"; http_uri; content:"token="; http_uri; content:"PayerID="; http_uri; content:"paymentId="; http_uri; pcre:"/\/checkout\/order-received\/\d+\?.*token=PAYID-[A-Z0-9]+.*PayerID=[A-Z0-9]+/Ui"; classtype:attempted-admin; sid:10000001; rev:1; metadata:created_at 2026_02_15, updated_at 2026_02_15, cve CVE-2026-15211; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-15211;)

Elastic Detection

sequence by source.ip with maxspan=10m
  [http where http.request.method == "GET" and http.request.uri like "*checkout/order-received*" and http.request.uri like "*token=*" and http.request.uri like "*PayerID=*"]
  [http where http.response.status_code == 200 and http.request.uri like "*checkout/order-received*"]

Note: In real deployments, correlate HTTP logs with WooCommerce order audit events. A more robust EQL:

sequence with maxspan=5m
  [http where http.request.method == "GET" and http.request.uri like "*/checkout/order-received/*" and http.request.uri like "*token=*"]
  [file where event.action == "update" and process.name == "php-fpm" and file.path like "*woocommerce/includes/class-wc-order.php*"]

Splunk SPL Query

index=web sourcetype=access_combined
| regex uri="/checkout/order-received/\d+"
| regex uri="token=PAYID-[A-Z0-9]+"
| regex uri="PayerID=[A-Z0-9]+"
| stats count by src_ip, uri, status
| where count > 3
| lookup woocommerce_orders order_id from uri AS order_id OUTPUT order_total
| where order_total > 100
| table _time, src_ip, uri, order_total, count, status

Wazuh OSSEC Rule

<group name="web_application,">
  <rule id="100101" level="12">
    <if_sid>31100</if_sid> <!-- Apache 200 success base rule -->
    <field name="url">\.*checkout/order-received/.*token=PAYID-.*PayerID=.*</field>
    <description>CVE-2026-15211: Possible WooCommerce Subscriptions payment bypass trying to mark order paid with injected PayPal token.</description>
    <group>web_application,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 — CLAIMED. NVD indicates the fix was released in version 2.0.1. This is a single-source claim (NVD); verify with the plugin vendor on wordpress.org before deployment.

Immediate Mitigations (before patching):

1. Disable guest checkout in WooCommerce → Settings → Accounts & Privacy → "Allow customers to place orders without an account." This requires an attacker to authenticate, significantly raising the exploitation bar (though registered users could still exploit it).
2. Disable PayPal as a payment method temporarily or restrict it to logged-in users only.
3. Add a WAF rule (Cloudflare, ModSecurity, or equivalent) to block requests to /checkout/order-received/* that contain both token= and PayerID= parameters, or match the Suricata regex above.
4. Enable manual order review for all PayPal orders: In WooCommerce → Settings → Payments → PayPal → "Payment Action" → set to "Manual Capture." This ensures no order is marked complete without merchant action, although it alters normal flow.

Patch/Upgrade Steps:

1. Back up the site and database.
2. Update the plugin via WordPress admin: Plugins → Installed Plugins → "Subscriptions for WooCommerce" → Update to version 2.0.1 or later.
3. Verify the update by checking the plugin's changelog for "Payment validation fix" or "Security fix."
4. After updating, flush object caches and clear WooCommerce transient caches.
5. Run a manual test: create a decoy low-value order, attempt the token-substitution attack against a high-value test product; confirm the order is rejected.

Long-Term Hardening:

• Keep all WooCommerce plugins up to date; enable automatic updates for security patches.
• Monitor plugin changelogs and actively subscribe to WordPress security advisories.
• Implement server-side webhook signature validation for all PayPal notifications (the fix in 2.0.1 should enforce this).
• Consider a dedicated security plugin (e.g., Wordfence) for virtual patching as a second layer.
• Regularly audit WooCommerce order status transitions via SOAR/automation: flag any order that moves from "pending" to "completed" without a corresponding PayPal IPN/webhook in the logs.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-15211 — Official CVE record with CVSS vector and description.
2. CWE-345: https://cwe.mitre.org/data/definitions/345.html — Insufficient Verification of Data Authenticity.
3. WordPress Plugin Repository: https://wordpress.org/plugins/subscriptions-for-woocommerce/ — Official plugin page; check changelog for version 2.0.1.
4. PayPal Order API Documentation: https://developer.paypal.com/docs/api/orders/v2/ — Reference for token/capture mechanics relevant to this bypass.
5. CISA KEV Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — CVE-2026-15211 is NOT listed (as of this report), indicating no confirmed in-the-wild exploitation. The public PoC for this CVE has been described in research forums; however, no exploit code is publicly available, and no threat actor campaigns have been publicly attributed to this CVE — monitor this space for updates.