If your WordPress site runs WooCommerce and accepts payments via PayPal, now is the time to double-check your security settings. In late September 2025, a significant exploit was uncovered that allowed hackers to run rampant “card testing” attacks via the new WooCommerce block-based checkout system—targeting thousands of vulnerable sites worldwide.
But what does this actually mean for your Australian small business? And more importantly, what can you do to prevent becoming the next victim?
This latest wave of attacks capitalised on a flaw in the block-based checkout introduced by WooCommerce in version 8.3 and above. While intended to modernise and streamline the purchase process, the new checkout system inadvertently opened the door to automated fraud attempts via PayPal’s gateway.
Hackers used bots to inject fake credit card details through the payment form. Because PayPal’s API processes the request before order completion, it allowed attackers to test thousands of stolen cards without triggering many standard defences. This is known as a card testing attack—where fraudsters validate stolen card numbers by attempting small purchases on low-security sites.
According to OOPSpam’s detailed report, one site logged over 448,000 fake transactions in less than a week.
These attacks weren’t aimed at massive eCommerce platforms. Instead, they focused on local businesses, especially those with basic web hosting or minimal security monitoring in place. This exploit highlights a chilling truth: cybercriminals know that small businesses often lack the resources to respond quickly or even notice the attack until it’s too late.
Once flagged, many PayPal merchant accounts were temporarily suspended or restricted—further damaging business operations. And the flood of failed transaction emails often brought down mail servers or triggered spam blacklisting.
If you’re unsure whether your site was affected, look for these signs:
Even if no actual payments were processed, the damage to your email reputation and PayPal account can be long-lasting.
The key issue lies in how the new block-based checkout handles PayPal transactions. Traditionally, order validation would occur before the payment gateway is invoked. But in the newer checkout flow, a payment attempt could be made via AJAX—meaning bots didn’t need to complete the full order process to run their tests. This bypassed many of the normal order checks and created a loophole.
WooCommerce and PayPal have since worked to patch the flaw—but if your store hasn’t been updated, you’re still at risk.
If your site accepts PayPal payments and uses WooCommerce blocks, here’s how to defend your store:
Let’s be honest—most Aussie small business owners don’t have a full-time IT department on standby. Whether you’re running a local café, florist, or tradie business, you rely on your site to just work. That’s why it’s critical to have a hosting partner who doesn’t leave you stranded when things go sideways.
At EdHosting, we’ve already helped multiple clients recover from bot-driven checkout spam. In some cases, it wasn’t just server resources being chewed up—email deliverability and PayPal access were jeopardised too.
It’s not just about lost sales. A compromised checkout experience damages your brand’s trust. It can get your PayPal account limited, your email blacklisted, and your hosting plan throttled. That’s why expert website hosting support isn’t a luxury anymore—it’s the difference between staying online or falling victim to the next exploit.
We go beyond generic security:
If you're not with a premium web hosting provider that offers these safeguards, you're vulnerable to the next wave of attacks—whether it’s block checkout abuse or something else.
While WooCommerce and PayPal are pushing fixes, the core issue is bigger. Today’s eCommerce environment is constantly evolving—and so are the threats. For small business websites in Australia, technical WordPress hosting expertise can no longer be optional. It’s essential.
If you’ve noticed weird PayPal behaviour, a spike in email usage, or just want peace of mind, we strongly recommend a full site review and security audit.
Don’t wait until your PayPal account is frozen or your site goes down.
Contact us today for a free threat assessment and let our team of real, local experts help keep your site—and your business—safe.
From premium web hosting for small businesses to scalable WordPress solutions backed by real support, EdHosting helps you stay one step ahead of hackers and downtime.
