What is the CVSS score of CVE-2026-14830?

CVE-2026-14830 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.1%.

Which versions of FlxWoo are affected by CVE-2026-14830?

FlxWoo WordPress plugin versions before 3.1.1 contain a critical payment verification bypass that allows any unauthenticated user to complete WooCommerce orders without payment.. A patch is available.

Is there a public PoC exploit available for CVE-2026-14830?

Yes, a public proof-of-concept exploit is available for CVE-2026-14830. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-14830?

Within 24 hours: Audit all WordPress instances to identify those running FlxWoo versions before 3.1.1 and assess current order volumes. Within 7 days: Deploy FlxWoo 3.1.1 or later across all affected systems, validate the patch is active, and conduct a manual review of orders placed in the past 72 hours for suspicious patterns (zero-value transactions, bulk orders). Within 30 days: Establish monitoring for order anomalies, review payment processor logs for settlement discrepancies, and communicate with affected customers about order integrity.

FlxWoo CVE-2026-14830

EUVD-2026-51411 HIGH

Improper Authentication (CWE-287)

2026-07-31 WPScan

GHSA-j2wf-m8xp-xm7q

WordPress Authentication Bypass Flxwoo Unknown

7.5

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

vuln.today AI

7.5 HIGH

Unauthenticated, low-complexity network abuse of the checkout callback (AV:N/AC:L/PR:N/UI:N) yields fraudulent paid orders - integrity-only (I:H), no confidentiality or availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 31, 2026 - 14:24 vuln.today

CVSS changed

Jul 31, 2026 - 14:22 NVD

7.5 (HIGH)

Patch available

Jul 31, 2026 - 07:01 EUVD

CVE Published

Jul 31, 2026 - 06:00 cve.org

HIGH 7.5

CVE Published

Jul 31, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

The FlxWoo WordPress plugin before 3.1.1 does not verify with the payment processor that a checkout session was actually paid before marking the associated order as paid, allowing unauthenticated attackers to complete WooCommerce orders without paying.

Articles & Coverage 1

News 17 New WordPress Vulnerabilities - 2 Critical, 13 With POC Aug 01, 2026

AnalysisAI

Payment verification bypass in the FlxWoo WordPress plugin before 3.1.1 allows unauthenticated attackers to complete WooCommerce orders without paying, because the plugin marks orders as paid without confirming the checkout session was actually settled with the payment processor. Publicly available exploit code exists, and a vendor patch is released; no active exploitation is confirmed in CISA KEV. The flaw enables fraudulent free acquisition of goods or services from any store running the plugin.

Technical ContextAI

FlxWoo is an integration plugin bridging WooCommerce (the dominant WordPress e-commerce framework) with a payment flow. The root cause is CWE-287 (Improper Authentication): rather than performing a server-to-server verification (a webhook or an authenticated API callback) against the payment processor to confirm a checkout session's payment status, the plugin trusts a client-driven return/callback and transitions the order to a paid state. This is a classic broken payment-confirmation pattern where the order-completion handler accepts the success signal without validating it out-of-band with the processor of record. The CPE 'cpe:2.3:a:unknown:flxwoo' identifies the affected component as the FlxWoo application across all versions up to the fix.

RemediationAI

Vendor-released patch: upgrade the FlxWoo plugin to version 3.1.1 or later, which is available from the vendor and is the primary fix. Review the WPScan advisory (https://wpscan.com/vulnerability/b866258c-b49b-40db-a0ff-6c0921b5c89f/) for details before updating. Until 3.1.1 is deployed, deactivate the FlxWoo plugin to force payment confirmation back to WooCommerce's native/processor-verified flow (trade-off: checkout via FlxWoo is disabled, interrupting sales), or reconcile all recent orders against the payment processor's dashboard to catch orders marked paid without a matching settled transaction and hold fulfillment of unverified orders. Enabling processor-side webhook verification or manual order review for high-value items reduces fraud exposure while patching is scheduled.