CVE-2026-83537 — WP Express Checkout < 2.5.0 - Unauthenticated Payment Bypass via wpec_process_empty_payment
The WP Express Checkout WordPress plugin before 2.5.0 does not verify server-side that a payment was actually completed before marking an order as paid, allowing unauthenticated…
Published: 2026-09-09 · CVSS: 5.3 · CVSS 3.1
The WP Express Checkout WordPress plugin before 2.5.0 does not verify server-side that a payment was actually completed before marking an order as paid, allowing unauthenticated users to forge a completed order without paying.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7