CVE-2026-17008 is a vulnerability in the Quick Paypal Payments WordPress plugin (through version 5.7.50) caused by insufficient verification of data authenticity (CWE-345). The plugin's PayPal IPN handler fails to verify critical payment details such as the paid amount, receiver, and payment status. It relies only on matching an order token to mark an order as paid, which can be exploited by an attacker to pay an arbitrary small amount and have the order incorrectly marked as fully paid.

This vulnerability allows an attacker to bypass payment verification and have orders marked as paid without actually paying the full amount. This can lead to financial loss for merchants using the affected plugin, as they may fulfill orders without receiving proper payment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling the plugin or implementing additional verification controls outside the plugin to validate payment authenticity.