If in a script is not required the PayPal Identity Token and you just add the email address for PayPal payments(just email, no api or identity token), the payment PayPal system is good for nothing, because with a simple url success you can upgrade your plan with a fake transaction. For this reason Midrub uses the Identity Token to verify if the payment was done as expected, expected money value and if transaction wasn’t done before.

You can read here How to get the PayPal Identity Token

For a success payment verification, you have to add in your plan the price with decimals. And you have to add correct Currency Code supported by PayPal https://developer.paypal.com/docs/classic/api/currency_codes/