PLUGIN SECURITY
Is Woocommerce Paypal Payments safe?
Known vulnerabilities, PHP compatibility and safer alternatives for the Woocommerce Paypal Payments WordPress plugin — checked against WP Clinic's local security database.
Plugin details
- Slug:
woocommerce-paypal-payments - Requires PHP: 7.4+
- Max supported PHP (analyzed): 8.4
Known vulnerabilities
- WooCommerce PayPal Payments [woocommerce-paypal-payments] < 2.0.5 [CVE-2023-35917, WordPress WooCommerce PayPal Payments Plugin <= 2.0.4 is vulnerable to Cross Site Request Forgery (CSRF), WooCommerce PayPal Payments <= 2.0.4 - Cross-Site Request Forgery, WooCommerce PayPal Payments < 2.0.5 - Merchant ID Details Update via CSRF]
- WooCommerce PayPal Payments [woocommerce-paypal-payments] < 4.0.2 [CVE-2026-9284, WooCommerce PayPal Payments <= 4.0.1 - Missing Authorization to Unauthenticated Order Manipulation and Information Disclosure, EUVD-2026-31524, WordPress WooCommerce PayPal Payments Plugin <= 4.0.1 is vulnerable to Broken Access Control]
Vulnerabilities are matched against the exact installed version when it's known. Always keep the plugin updated to the latest release.
Safer / more established alternatives
- WooCommerce — 7000000+ active installs
- Popup Builder & Popup Maker for WordPress – OptinMonster Email Marketing and Lead Generation — 1000000+ active installs — max PHP 8.4
- WooPayments: Integrated WooCommerce Payments — 900000+ active installs — max PHP 8.4
- WooCommerce Stripe Payment Gateway — 700000+ active installs — max PHP 8.4
- Mailchimp for WooCommerce — 200000+ active installs — max PHP 8.4
Check your own WordPress site
Run a free passive scan now, or create a free account and install the WP Clinic plugin for a deep scan of your whole hosting account and AI-assisted repair.