CVE-2026-83537: WP Express Checkout < 2.5.0 - Unauthenticated Payment Bypass via wpec_process_empty_payment
The WP Express Checkout WordPress plugin before 2.5.0 does not verify server-side that a payment was actually completed before marking an order as paid, allowing unauthenticated users to forge a completed order without paying.
Affected Software
Event History
Frequently Asked Questions
Which installations are affected?
Installations using WP Express Checkout versions earlier than 2.5.0 are affected. The issue is in the wpec_process_empty_payment functionality.
Does exploitation require an account or customer interaction?
No. The issue can be exploited by an unauthenticated user and does not require user interaction.
What must an attacker do to exploit this issue?
An attacker must forge a request that causes an order to be treated as completed. The plugin does not perform server-side verification that payment was actually completed before marking the order as paid.
What is the impact of successful exploitation?
An attacker can cause a completed order to be recorded without making a payment. The provided severity vector indicates an integrity impact and no stated confidentiality or availability impact.