3.7
Low
CVE-2026-17016 The Accept PayPal & Stripe with Subscriptions for WooCommerce WordPress plugin through 3.1.0 does not validate the…
Description
The Accept PayPal & Stripe with Subscriptions for WooCommerce WordPress plugin through 3.1.0 does not validate the amount actually paid against the order total in its PayPal Data Transfer return handler, allowing a customer to pay less than the order total and still have the order marked as fully paid when the PayPal Data Transfer feature is enabled.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Accept PayPal & Stripe with Subscriptions for WooCommerce 3.1 | earliest → 3.1.0 | No fix stated |