CVE-2026-83537 — WP Express Checkout < 2.5.0 - Unauthenticated Payment Bypass via wpec_process_empty_payment

CVE-2026-83537

WP Express Checkout < 2.5.0 - Unauthenticated Payment Bypass via wpec_process_empty_payment PUBLISHED

Description (CNA)

The WP Express Checkout WordPress plugin before 2.5.0 does not verify server-side that a payment was actually completed before marking an order as paid, allowing unauthenticated users to forge a completed order without paying.

Affected (CNA)

Vendor / product	Versions
Unknown / WP Express Checkout	affected 0 before 2.5.0

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/02b39e4f-181d-4573-9175-bf5a6d71e531/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.