---
id: CVE-2026-121633
title: >-
  Order Tracking < 3.6.0 - Unauthenticated Payment Confirmation Forgery via
  PayPal IPN Listener
summary: >-
  The Order Tracking WordPress plugin before 3.6.0 does not verify that a PayPal
  payment notification was sent to the merchant's account, or that its amount
  matches the order total, before marking an order as paid, which could allow
  unauth…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-345
product: Order Tracking
affected:
  - order_tracking < 3.6.0
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-11-06T11:41:13.306175Z'
published: '2026-11-06'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T11:50:26.197Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-121633'
references:
  - url: 'https://wpscan.com/vulnerability/5eafeeb0-0bea-4647-a178-d5a2f2282afa/'
tags:
  - cve.org
ingestedAt: '2026-11-06T07:47:15.872Z'
epss: 0.00114
epssPercentile: 0.01515
---

## Overview

The Order Tracking WordPress plugin before 3.6.0 does not verify that a PayPal payment notification was sent to the merchant's account, or that its amount matches the order total, before marking an order as paid, which could allow unauthenticated attackers to mark arbitrary orders as paid using a trivial payment to their own PayPal account.

## Affected

- `order_tracking < 3.6.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.