Quick Paypal Payments IPN validation permits underpayment
Quick Paypal Payments through 5.7.50 exposes its PayPal IPN listener through qpp_ipn() on the default /?qpp_ipn URL. The listener matched the PayPal custom order token but did not verify the received amount, currency, receiving PayPal account or completed payment status. An unauthenticated buyer could therefore pay an arbitrary small amount and have a full-price order marked paid. Version 5.7.51 adds amount, currency, recipient and payment-status checks plus replay protection.
- Component
- Quick Paypal Payments
- Plugin slug
quick-paypal-payments- Affected
- <= 5.7.50
- Safe version
5.7.51- Published
- Aug 12, 2026
- Weakness
- Not assigned
This CVE was published Aug 12, 2026 and is one of 9 known issues for this plugin.
Update, patch or deactivate.
Update to 5.7.51 or later. Review PayPal transactions against marked-paid orders, correct fraudulent order states, and suspend fulfilment where the paid amount or recipient does not match the order.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Quick Paypal Payments WordPress plugin through 5.7.50 does not verify the paid amount, receiver, or payment status in its PayPal IPN handler and marks an order paid on an order-token match alone, so a buyer who pays an arbitrary small amount can have a full-price order marked paid.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N