{"schemaVersion":3,"id":"CVE-2019-7441","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"cgi-bin/webscr?cmd=_cart in the WooCommerce PayPal Checkout Payment Gateway plugin 1.6.8 for WordPress allows Parameter Tampering in an amount parameter (such as amount_1), as demonstrated by purchasing an item for lower than the intended price. NOTE: The plugin author states it is true that the amount can be manipulated in the PayPal payment flow. However, the amount is validated against the WooCommerce order total before completing the order, and if it doesn’t match then the order will be left in an “On Hold” state","dates":{"published":"2019-03-20T20:10:37.000Z","modified":"2024-08-04T20:46:46.372Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":6.5,"severity":"medium","version":"3.0","versionLabel":"v3.0","source":"NVD","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.0","versionLabel":"v3.0","source":"NVD","score":6.5,"severity":"medium","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":4,"severity":"medium","vector":"AV:N/AC:L/Au:S/C:N/I:P/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.05939,"percentile":0.9323,"severity":"low","asOf":"2026-10-21T00:00:00.000Z","change":{"pp":0.48199999999999976,"baselineDate":"2026-09-21T00:00:00.000Z","baselineScore":0.05457},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.05939,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.05939,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.05939,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.05939,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.05939,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.05939,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.05939,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.05457,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.05939,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.05939,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.05939,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.05939,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.05939,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.05939,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.05939,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.05939,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.05939,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.05939,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.05939,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.05939,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.05939,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.05939,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.05939,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.05939,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.05939,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.05939,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.05939,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.05939,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.05939,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.05939,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.05939,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.05939,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.05939,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.05939,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.05939,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.05939,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.05939,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.05939,"percentile":0.9323}],"last30":[{"date":"2026-09-21T00:00:00.000Z","score":0.05457,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.05939,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.05939,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.05939,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.05939,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.05939,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.05939,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.05939,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.05939,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.05939,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.05939,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.05939,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.05939,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.05939,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.05939,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.05939,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.05939,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.05939,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.05939,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.05939,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.05939,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.05939,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.05939,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.05939,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.05939,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.05939,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.05939,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.05939,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.05939,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.05939,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.05939,"percentile":0.9323}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[{"id":"REF_454F35A98E174401","name":"Exploit Reference (gkaim.com)","source":"reference","url":"https://gkaim.com/cve-2019-7441-vikas-chaudhary/","maturity":"unknown","reliabilityScore":0.2,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null},{"id":"46632","name":"WordPress Plugin PayPal Checkout Payment Gateway 1.6.8 - Parameter Tampering","source":"exploit-database","url":"https://www.exploit-db.com/exploits/46632","maturity":"poc","reliabilityScore":0.5,"verified":false,"type":null,"platforms":["php"],"requiresAuth":null,"exploitdb":{"verified":false,"type":"webapps","platform":"php","file":"exploits/php/webapps/46632.txt","codes":["CVE-2019-7441"]},"metasploit":null}],"exploitCount":2,"weaknesses":[],"affected":[{"vendor":"woocommerce","product":"paypal_checkout_payment_gateway","name":"paypal checkout payment gateway","label":"paypal_checkout_payment_gateway","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"1.6.8","noFixRecorded":false,"fixedIn":null}],"versionsText":"1.6.8","eol":null,"hubHref":"/vendor/woocommerce/paypal_checkout_payment_gateway"}],"affectedCount":1,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://gkaim.com/cve-2019-7441-vikas-chaudhary/","label":"gkaim.com/cve-2019-7441-vikas-chaudhary/","hostname":"gkaim.com","tags":["X Refsource MISC","Exploit","Third Party Advisory"]},{"url":"https://www.exploit-db.com/exploits/46632/","label":"www.exploit-db.com/exploits/46632/","hostname":"www.exploit-db.com","tags":["Exploit","X Refsource EXPLOIT DB"]},{"url":"http://packetstormsecurity.com/files/152362/WordPress-PayPal-Checkout-Payment-Gateway-1.6.8-Parameter-Tampering.html","label":"packetstormsecurity.com/files/…","hostname":"packetstormsecurity.com","tags":["X Refsource MISC"]},{"url":"https://wordpress.org/support/topic/vulnerabilty-in-plugin/#post-11899173","label":"wordpress.org/support/topic/vulnerabilty-in-plugin/","hostname":"wordpress.org","tags":["X Refsource MISC"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2019-03-20T20:10:37.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-08-04T20:46:46.372Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":37,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-22T12:13:59.541Z","stale":false,"partial":false}}