Surely the script should also verify that:
- payment_status = MUST only set the order to complete if this variable is set to "Completed"
- receiver_email = MUST match the merchant's email as registered with paypal
- mc_currency = MUST match the currency of the order
- mc_gross = MUST match the cost of the order
- item_name = MUST match the order name / id (however I noticed opencart uses the custom field for this)
- transaction_id = MUST be unique (An item has never been purchased before with the same ID, therefore must be stored in the opencart database and matched against all new orders)
Forgive me if I have overlooked anything.