Security is an ongoing commitment; sometimes, despite our best efforts, vulnerabilities slip through the cracks. We recently addressed an order manipulation issue in Sylius PayPalPlugin and released security patches. However, after further investigation, we discovered that the initial fix included in this week’s security release was incomplete. We sincerely apologize for this oversight and have issued an updated patch to resolve the issue fully.

If you are using Sylius PayPalPlugin in versions below 1.6.2, 1.7.2, or 2.0.2, we strongly urge you to update immediately. This vulnerability could allow malicious users to manipulate their shopping carts post-checkout, leading to potential financial losses for merchants.

Keeping your store secure is our top priority, and we appreciate your trust and vigilance in maintaining a safe eCommerce environment. Below, we outline the details of the issue, its impact, and the necessary steps to protect your business.

PayPalPlugin 1.6 and above

Is my store affected by this vulnerability?

This issue exists in all PayPalPlugin versions before 1.6.2, 1.7.2 and 2.0.2.

Description

A discovered vulnerability allows users to modify their shopping cart after completing the PayPal Checkout process and payment authorization. If a user initiates a PayPal transaction from a product page or the cart page and then returns to the order summary page, they can still manipulate the cart contents before finalizing the order. As a result, the order amount in Sylius may be higher than the amount actually captured by PayPal, leading to a scenario where merchants deliver products or services without full payment.

Impact

• Users can exploit this flaw to receive products/services without paying the full amount.
• Merchants may suffer financial losses due to underpaid orders.
• Trust in the integrity of the payment process is compromised.

Patches

The issue is fixed in versions: 1.6.2, 1.7.2, 2.0.2 and above.

Workarounds

If an immediate upgrade is not possible, merchants should take the following actions to mitigate risk:

• Disable PayPal: To prevent fraudulent transactions, merchants should immediately disable the PayPal payment method in their shops.
• Schedule an upgrade or a workaround implementation: Merchants should coordinate with their development teams to upgrade to a patched version of the PayPalPlugin (1.6.2, 1.7.2 or 2.0.2) as soon as possible or to have the workaround described in the security advisory implemented.

Keeping your store secure is crucial – please update your plugin and inform your peers in the Sylius community about this fix to ensure a safer environment for all.