CVE-2026-17016
LowCVSS 3.7Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
The Accept PayPal & Stripe with Subscriptions for WooCommerce WordPress plugin through version 3.1.0 does not validate the amount actually paid against the order total in its PayPal Data Transfer return handler, allowing a customer to pay less than the order total and still have the order marked as fully paid when the PayPal Data Transfer feature is enabled.
Risk Assessment
Financial loss risk – customers can intentionally pay less, and the store loses revenue, impacting profitability.
Recommendation
Update the plugin and implement payment amount validation against order total in the PayPal Data Transfer handler.
Original NVD description (English source)
The Accept PayPal & Stripe with Subscriptions for WooCommerce WordPress plugin through 3.1.0 does not validate the amount actually paid against the order total in its PayPal Data Transfer return handler, allowing a customer to pay less than the order total and still have the order marked as fully paid when the PayPal Data Transfer feature is enabled.