CVE-2026-16990 affects the Payment Button for PayPal WordPress plugin through version 1.2.3.44. The plugin fails to enforce the merchant-configured payment amount on the server side, instead trusting the amount provided by the client. This design flaw (CWE-602) enables unauthenticated attackers to create real PayPal orders against the merchant for arbitrary lower amounts, potentially causing financial loss. The vulnerability has a CVSS 3.1 score of 5.3 (medium severity) with no privileges required and no user interaction needed. No patch or official remediation level has been disclosed by the vendor, and no exploits are known to be active in the wild.

An attacker can exploit this vulnerability to create PayPal orders with payment amounts lower than those set by the merchant, potentially resulting in financial loss to the merchant. The vulnerability does not impact confidentiality or availability but affects the integrity of payment transactions by allowing unauthorized manipulation of payment amounts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, merchants should consider disabling the plugin or implementing server-side validation of payment amounts to ensure client-supplied data cannot override merchant-configured prices.