CVE-2025-7820

—

CVSS 3.1

7.5 high

EPSS

<1%p26

Published

Nov 27, 2025 (Nov 27, 2025)

Modified

Jun 17, 2026

Description

The SKT PayPal for WooCommerce plugin for WordPress is vulnerable to Payment Bypass in all versions up to, and including, 1.4. This is due to the plugin only enforcing client side controls instead of server-side controls when processing payments. This makes it possible for unauthenticated attackers to make confirmed purchases without actually paying for them.

Ecosystems: WordPress, E-commerce
Weakness: CWE-602
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

NVD CVE.org GitHub PoCs EPSS (0.3%)

In the news0 stories

No ingested article mentions this CVE yet.