Is Payment Gateway for PayPal on WooCommerce safe?

Every recorded flaw

• Sep 21, 2026Payment Gateway for PayPal on WooCommerce: Does not verify that an incoming payment notification was confirmed in the store's configured payment environment or paid to the store's own merchant account before marking an oCVE-2026-92400 · fixed in 9.2.1 · reported by WPScanMedium 5.3
• Aug 12, 2026Payment Gateway for PayPal on WooCommerce: Does not verify that payment actually succeeded before completing an order in its PayPal return handler: it reads attacker-controlled parametersCVE-2026-16621 · fixed in 9.2.1 · reported by WPScanMedium 5.3
• Jul 23, 2026Unauthenticated Broken Access Control in Payment Gateway for PayPal on WooCommerce <= 9.1.4 versions.CVE-2026-59547 · affects up to 9.1.4 · reported by PatchstackHigh 7.5
• Dec 9, 2025Payment Gateway for PayPal on WooCommerce: Missing AuthorizationCVE-2025-63023 · affects up to 9.0.53 · reported by PatchstackMedium 5.3

Records come from the National Vulnerability Database, published by the researchers who found each flaw (Wordfence, Patchstack, WPScan and others); exploited status from CISA; exploit odds from FIRST’s EPSS; current version, installs and closures from wordpress.org, checked daily. Want every plugin on your site checked at once? Run the free website check.