CVE-2026-83533 — WP Express Checkout < 2.4.9 - Unauthenticated Payment Bypass via wpec_process_payment

CVE-2026-83533

WP Express Checkout < 2.4.9 - Unauthenticated Payment Bypass via wpec_process_payment PUBLISHED

Description (CNA)

The WP Express Checkout WordPress plugin before 2.4.9 does not verify server-side that a payment was actually completed before marking an order as paid, allowing unauthenticated users to forge a completed order without paying.

Affected (CNA)

Vendor / product	Versions
Unknown / WP Express Checkout	affected 0 before 2.4.9

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/8ffb76d6-fda5-4819-ab07-d8c086169110/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.