CVE-2026-16621 is a vulnerability in the Payment Gateway for PayPal on WooCommerce WordPress plugin prior to version 9.2.1. The plugin's PayPal return handler fails to verify payment success properly: it reads parameters that can be controlled by an attacker, performs no comparison of payment amounts, and does not check if the order belongs to the user making the request. As a result, an unauthenticated attacker can mark arbitrary orders as paid without completing payment, bypassing server-side gateway verification.

An attacker can fraudulently mark orders as paid without actually paying, potentially leading to unauthorized order fulfillment and financial loss for merchants using the affected plugin versions. The vulnerability does not impact confidentiality or availability but allows integrity violation of order payment status.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch link is provided, users should monitor the vendor's announcements and update to version 9.2.1 or later once a fix is confirmed. Until then, consider disabling the plugin or implementing additional manual verification of payment status to prevent fraudulent order completion.