FlxWoo CVE-2026-14830

The store must be running the FlxWoo plugin below 3.1.1 as its WooCommerce payment/order-confirmation integration, with checkout reachable over the network. Exploitation requires no authentication, no privileges, and no user interaction (AV:N/AC:L/PR:N/UI:N) - an attacker only needs to initiate a checkout and invoke the order-completion path that FlxWoo trusts without processor-side verification. The practical limiting factor is deployment scope: only stores that use FlxWoo (not stock WooCommerce or other payment gateways) to mark orders paid are affected, and impact is limited to fraudulent order completion (integrity), not data disclosure or site downtime.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, 7.5 High) reflects a network-reachable, low-complexity, unauthenticated integrity-only impact - consistent with the description of anyone completing an order without paying. This is a genuine, easily-abusable business-logic/authentication flaw rather than an inflated high-CVSS issue: a public POC exists and no user interaction or privileges are required. There is no confidentiality or availability impact, so it will not appear as data theft or outage, but it directly enables financial fraud. No EPSS score was supplied in the input, and the vulnerability is not listed in CISA KEV, so widespread automated exploitation is not confirmed; however, the combination of unauthenticated network access, low complexity, and published exploit code means opportunistic abuse against exposed stores should be treated as a near-term priority. No signals conflict: the network vector and unauthenticated rating align with the described attack.

An attacker adds items to the cart on a store running vulnerable FlxWoo, proceeds to checkout, and triggers the order-completion callback without actually completing payment at the processor. Because the plugin does not verify settlement with the payment processor, the order is marked paid and moves to fulfillment, letting the attacker obtain goods or services for free. A public POC lowers the skill required to reproduce this.