WP Express Checkout CVE-2026-83533

No special conditions are required beyond the target site running WP Express Checkout below version 2.4.9 with an active storefront. Exploitation is fully unauthenticated (CVSS PR:N) and requires no user interaction (UI:N). Any network-reachable WordPress site using this plugin for payment processing is exposed. The limiting factor is that the attacker must be able to reach the WordPress checkout endpoint and initiate a checkout session to obtain the request structure to forge - but this is trivially achievable from any browser with no account registration required.

The provided CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N (5.3) significantly understates real-world impact. The I:L rating does not adequately capture that forging a completed payment is not a minor integrity modification - it constitutes financial fraud enabling theft of goods or services. An independent assessment places this at I:H (7.5). EPSS data is absent from the input, but the combination of a publicly available WPScan proof-of-concept, zero prerequisites (unauthenticated, no special configuration), and direct financial incentive for attackers makes this a high-priority patch for any site processing revenue through this plugin. No KEV listing is noted, but financially motivated opportunistic scanning is a realistic threat pattern.

An attacker browses the target WordPress store, initiates a checkout via WP Express Checkout, and then crafts or replays the payment-confirmation HTTP request with parameters indicating a completed payment - without going through the actual PayPal or Stripe payment flow. The server accepts the forged state, marks the order as paid, and may fulfill digital or physical goods. A public proof-of-concept is available through WPScan, lowering the skill barrier for exploitation.