CVE-2026-16990 — Payment Button for PayPal <= 1.2.3.44 - Unauthenticated Payment Price Manipulation
The Payment Button for PayPal WordPress plugin through 1.2.3.44 does not enforce the merchant-configured price server-side and trusts a client-supplied payment amount, allowing …
Published: 2026-08-12 · CVSS: 5.3 · CVSS 3.1
The Payment Button for PayPal WordPress plugin through 1.2.3.44 does not enforce the merchant-configured price server-side and trusts a client-supplied payment amount, allowing unauthenticated attackers to create a real PayPal order against the merchant for an arbitrary lower amount.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7