The Subscriptions for WooCommerce plugin versions prior to 2.0.1 do not verify that the PayPal order token used in the WooCommerce order-received flow matches the order being completed, nor do they validate that the captured payment amount corresponds to the order total. The plugin accepts a client-supplied PayPal order token and marks the order as paid if the capture status is COMPLETED, regardless of the actual payment amount. This insufficient verification of data authenticity (CWE-345) enables attackers to manipulate payment tokens to fraudulently mark orders as paid without proper payment.

An attacker can exploit this vulnerability to have expensive orders marked as paid without making the corresponding payment. This could lead to financial loss for merchants using the affected plugin, as unauthorized orders may be fulfilled without receiving payment. The vulnerability requires guest checkout to be enabled and does not disclose confidentiality or availability impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to disable guest checkout or avoid using the vulnerable versions of the Subscriptions for WooCommerce plugin. Monitor vendor channels for updates and apply patches promptly once released.