EUVD-2026-51411
GHSA-j2wf-m8xp-xm7q
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Unauthenticated, low-complexity network abuse of the checkout callback (AV:N/AC:L/PR:N/UI:N) yields fraudulent paid orders - integrity-only (I:H), no confidentiality or availability impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Lifecycle Timeline
5DescriptionCVE.org
The FlxWoo WordPress plugin before 3.1.1 does not verify with the payment processor that a checkout session was actually paid before marking the associated order as paid, allowing unauthenticated attackers to complete WooCommerce orders without paying.
Articles & Coverage 1
AnalysisAI
Payment verification bypass in the FlxWoo WordPress plugin before 3.1.1 allows unauthenticated attackers to complete WooCommerce orders without paying, because the plugin marks orders as paid without confirming the checkout session was actually settled with the payment processor. Publicly available exploit code exists, and a vendor patch is released; no active exploitation is confirmed in CISA KEV. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The store must be running the FlxWoo plugin below 3.1.1 as its WooCommerce payment/order-confirmation integration, with checkout reachable over the network. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, 7.5 High) reflects a network-reachable, low-complexity, unauthenticated integrity-only impact - consistent with the description of anyone completing an order without paying. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker adds items to the cart on a store running vulnerable FlxWoo, proceeds to checkout, and triggers the order-completion callback without actually completing payment at the processor. Because the plugin does not verify settlement with the payment processor, the order is marked paid and moves to fulfillment, letting the attacker obtain goods or services for free. … |
| Remediation | Vendor-released patch: upgrade the FlxWoo plugin to version 3.1.1 or later, which is available from the vendor and is the primary fix. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Audit all WordPress instances to identify those running FlxWoo versions before 3.1.1 and assess current order volumes. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today