EUVD-2026-70046
GHSA-rr9j-x6q5-q5pf
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Forging a completed payment is a material integrity breach enabling financial fraud; I:H reflects that orders can be fully falsified without any legitimate transaction.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The WP Express Checkout WordPress plugin before 2.4.9 does not verify server-side that a payment was actually completed before marking an order as paid, allowing unauthenticated users to forge a completed order without paying.
AnalysisAI
Payment verification bypass in WP Express Checkout WordPress plugin before 2.4.9 allows unauthenticated remote attackers to forge completed orders without submitting actual payment. The plugin fails to perform server-side confirmation that a payment transaction was successfully processed before transitioning an order to 'paid' status, enabling fraudulent order completion. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions are required beyond the target site running WP Express Checkout below version 2.4.9 with an active storefront. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N (5.3) significantly understates real-world impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update WP Express Checkout to version 2.4.9 or later immediately via the WordPress plugin dashboard or by downloading from the WordPress.org plugin repository. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Wp Express Checkout
View allPayment bypass in the WP Express Checkout WordPress plugin (versions before 2.5.0) allows unauthenticated users to forge
The WP Express Checkout plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘pec_coupon[code]’ par
Share
External POC / Exploit Code
Leaving vuln.today