→ برگشت به فید آسیب‌پذیری‌ها CVE-2026-15211 · subscriptions-for-woocommerce

دور زدن مبالغ در درگاه پرداخت (Payment Bypass) در افزونه Subscriptions for WooCommerce

The Subscriptions for WooCommerce plugin for WordPress is vulnerable to Payment Verification Bypass in versions up to, and including, 2.0.0. This is due to missing validation binding the PayPal capture token returned in the GET parameter to the PayPal order ID actually created for the WooCommerce order at checkout. This makes it possible for unauthenticated attackers to bypass payment by supplying an arbitrary attacker-controlled PayPal capture token, marking orders as paid without a legitimate corresponding payment.