CVE-2026-121993: wePOS before 2.0.3 Missing Authorization via payment/process Endpoint
wePOS (Point Of Sale for WooCommerce) before 2.0.3 contains a missing authorization vulnerability in the wepos/v1/payment/process REST route that allows authenticated vendor-level users to mark arbitrary orders as paid and completed by supplying another order's ID. Attackers with only the publishshoporders capability (such as Dokan vendor staff) can invoke the payment processing endpoint with an order ID they do not own to trigger the order completion lifecycle, including stock reduction and granting of paid-order access, without making any real payment.
Event History
Frequently Asked Questions
Which users are able to exploit this issue?
Any authenticated user with the publish_shop_orders capability can exploit it. The description specifically identifies Dokan vendor staff as an example of a role that may have this capability.
What must an attacker do to exploit the vulnerable endpoint?
The attacker needs to call the wepos/v1/payment/process REST route while authenticated and provide the ID of an order they do not own. No real payment is required.
What is the practical impact on an affected order?
An attacker can mark an arbitrary order as paid and completed. This triggers the normal completion lifecycle, including stock reduction and granting access associated with paid orders.
Which versions are affected?
Versions of wePOS before 2.0.3 are affected.