Problem with repeated fake orders with the PayPal Woocommerce Plugin

[TS2188]

Using WooCommerce PayPal Payments - had a problem with repeated fake orders exploiting a vulnerability with the PayPal button. Added a captcha to the checkout which prevents the bots placing orders through Apple Pay and Google Pay (via Paypal). However, the Paypal button itself can be clicked even if the Captcha has been ignored, so the Paypal button is vulnerable and we can't prevent spam orders. The orders are spaced about 15 minutes apart, for the cheapest items in our store. From multiple IPs: 1[Removed. Phone #s not permitted] [removed] IPs are from all over. Germany, UK, Hong Kong, etc We've had to disable Paypal on all our sites until we can find a solution. Seems to be an issue with the Plugin but who do we contact to fix it?

https://woocommerce.com/document/woocommerce-paypal-payments/#get-help directed us to Paypal.

Thanks, hope someone can help 🙂

[spoonofmilk]

Same as Ruth, our client has now reported the same issue - refund request from PayPal, but not sure what to do. I've suggested they contact PayPal directly, but subscribing to this thread to see if anyone has more info on the exact outcome of the situation!

[TS2188]

No further problems since we disabled Advanced Card Processing. We are still taking payments through Paypal itself, plus Apple Pay and Google Pay (through Paypal) no problems.

[teehwhy]

The Solution is to turn off auto update for the Woocommerce Paypal plugin and change the code in this directory. 

\woocommerce-paypal-payments\modules\ppcp-button\src\Endpoint\CreateOrderEndpoint.php ... at the beginning of this function

   private function create_paypal_order( \WC_Order $wc_order = null, string $payment_method = '', array $data = array() ) : Order {

       // Check origin source from session


if (!isset($_COOKIE['sbjs_first'])) {
      throw new RuntimeException(
        __('Order creation failed: Origin source is required.', 'woocommerce-paypal-payments')
    );

}
    assert( $this->purchase_unit instanceof PurchaseUnit );

 Note: this is a temporary fix. You can check other cookies that relate to the origin source to harden the condition.