CVE-2026-16990

This CVE exposes a price manipulation vulnerability in a WordPress PayPal plugin (versions up to 1.2.3.44). The plugin accepts the payment amount from client-side input rather than validating it against a server-side configuration. An attacker intercepts the `amount` parameter and submits a dramatically reduced value — a $100 purchase becomes $0.01, and PayPal processes it as a valid transaction. The CVSS 5.3 score is misleading. This is not a medium-severity technical flaw with financial consequences — it is a direct fraud mechanism. No authentication bypass, memory corruption, or exploit chaining is required. The attacker simply changes a number in an HTTP request and gets a deflated transaction. CVSS measures technical exploitation difficulty, which is low here, but completely ignores the direct cash conversion. A 5.3 score for a flaw that empties merchant accounts is a framework failure, not an accurate assessment. For defenders: audit any WordPress payment plugin to confirm it retrieves amounts exclusively from server-side configuration, never from `$_POST` or `$_GET` parameters. If client-supplied amounts are in use, treat that as active fraud exposure. The plugin reaching version 1.2.3.44 without this being caught reflects a systemic gap — the WordPress plugin repository performs content policy checks, not security audits, and provides no static analysis for payment validation gaps. The EPSS score of 0.00194 measures opportunistic scanner activity, not targeted exploitation. A determined actor can enumerate all merchants running this plugin and harvest across them methodically. Each individual theft is small enough to avoid merchant fraud alerts. The exposure is perpetual — unlike compiled software where old versions become untenable, vulnerable plugin versions remain downloadable and installable indefinitely.

Reviewed through automated stages and approved by a human before publication.