CVE-2026-83533 — WP Express Checkout < 2.4.9 - Unauthenticated Payment Bypass via wpec_process_payment
The WP Express Checkout WordPress plugin before 2.4.9 does not verify server-side that a payment was actually completed before marking an order as paid, allowing unauthenticated…
Published: 2026-09-02 · CVSS: 5.3 · CVSS 3.1
The WP Express Checkout WordPress plugin before 2.4.9 does not verify server-side that a payment was actually completed before marking an order as paid, allowing unauthenticated users to forge a completed order without paying.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7