CVE-2025-30152 Sylius PayPal Plugin has an Order Manipulation Vulnerability after PayPal Checkout

What is CVE-2025-30152?

CVE-2025-30152 is a medium-severity vulnerability in Sylius PayPalPlugin, published on 19 Mar 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

The Syliud PayPal Plugin is the Sylius Core Team’s plugin for the PayPal Commerce Platform. Prior to 1.6.2, 1.7.2, and 2.0.2, a discovered vulnerability allows users to modify their shopping cart after completing the PayPal Checkout process and payment authorization. If a user initiates a PayPal transaction from a product page or the cart page and then returns to the order summary page, they can still manipulate the cart contents before finalizing the order. As a result, the order amount in Sylius may be higher than the amount actually captured by PayPal, leading to a scenario where merchants deliver products or services without full payment. The issue is fixed in versions: 1.6.2, 1.7.2, 2.0.2 and above.

Weakness: CWE-472

Which versions are affected by CVE-2025-30152?

6 open source packages ship an affected version, including sylius/paypal-plugin.

How do I fix CVE-2025-30152?

Upgrade sylius/paypal-plugin to a fixed version for your release line: 1.6.2, 1.7.2 or 2.0.2.

Is CVE-2025-30152 being exploited?

There is no known exploitation of CVE-2025-30152 in the wild and no public exploit code.

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-hxg4-65p5-9w37.