AIKIDO-2026-951311
sylius/paypal-plugin is vulnerable to Server-Side Request Forgery (SSRF)
100
Critical Risk
This Affects:
sylius/paypal-pluginTL;DR
The PayPal refund webhook endpoint in the plugin does not verify that incoming requests genuinely originate from PayPal. It reads a resource URL directly from the unauthenticated request body and fetches it while attaching the merchant's PayPal OAuth access token as a bearer credential, so a request pointed at a caller-controlled server leaks the token and turns the server into an authenticated request proxy. The same forged response also drives a payment state change, letting an unverified webhook mark a local payment as refunded and issue a real PayPal refund using the merchant's credentials. The fix verifies the PayPal webhook signature and required transmission headers before processing and rejects unverified requests.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your store has the PayPal refund webhook endpoint in use.
Background info
sylius/paypal-plugin is vulnerable to Server-Side Request Forgery (SSRF) in versions 1.0.0 - 1.7.8 and 2.0.0 - 2.0.10.
How to fix this
Upgrade the sylius/paypal-plugin library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant