CVE-2026-83533: WP Express Checkout < 2.4.9 - Unauthenticated Payment Bypass via wpec_process_payment
The WP Express Checkout WordPress plugin before 2.4.9 does not verify server-side that a payment was actually completed before marking an order as paid, allowing unauthenticated users to forge a completed order without paying.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
WordPress sites using WP Express Checkout versions earlier than 2.4.9 are affected. The issue can be exploited remotely without authentication.
What does an attacker need to do to exploit it?
An attacker can forge a completed order through the wpec_process_payment functionality without actually making a payment. No user interaction or prior privileges are required.
What is the impact of successful exploitation?
A successful attacker can cause an order to be marked as paid despite no payment having been completed. The provided severity vector indicates an integrity impact, with no stated confidentiality or availability impact.
What should be done to remediate the issue?
Update WP Express Checkout to version 2.4.9 or later. The provided data does not identify a workaround for installations that cannot be updated immediately.