Is CVE-2026-9284 actively exploited?

No active exploitation of CVE-2026-9284 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-9284 be exploited remotely?

Yes. CVE-2026-9284 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-9284?

CVE-2026-9284 has a CVSS score of 8.2 (HIGH).

HOME VULNERABILITIESCVE-2026-9284

HIGH

CVE-2026-9284

CWE-862Published: May 23, 2026· Updated: May 26, 2026

8.2

CVSS v3.1

EPSS:0.06%probability of exploitation in 30 daysPercentile:18.3th

Official Description

The WooCommerce PayPal Payments plugin for WordPress is vulnerable to unauthorized order manipulation and information disclosure due to missing authorization checks on the `ppc-create-order` and `ppc-get-order` WC-AJAX endpoints in all versions up to, and including, 4.0.1. The `ppc-create-order` endpoint accepts an arbitrary WooCommerce order ID in the `pay-now` context without validating order ownership, allowing attackers to create PayPal orders for any WC order and write PayPal metadata to it. The `ppc-get-order` endpoint returns full PayPal order details for any PayPal order ID without binding to the requester's session. This makes it possible for unauthenticated attackers to chain these endpoints to manipulate other customers' order payment flows and exfiltrate sensitive order details (payer information, shipping data) by creating a PayPal order for a victim's WC order and then retrieving the PayPal order data.

NVD Source

Technical Analysis

CVE-2026-9284 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in complete confidentiality breach (data exposure), with a CVSS base score of 8.2.