Threats tagged 'ghsa-p384-7c3j-gqm7'

CVE-2026-15211 is a medium severity vulnerability in the Subscriptions for WooCommerce WordPress plugin before version 2.0.1. The plugin fails to validate the payment amount or bind the PayPal order token to the specific WooCommerce order during the order completion process. This flaw allows an unauthenticated attacker, when guest checkout is enabled, to substitute an approved but uncaptured PayPal order token and have an expensive order marked as paid without actually paying the required amount.