EUVD-2026-74723
GHSA-89f9-r4mq-rxxm
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Network unauthenticated with no interaction; integrity impact is Low (forged order state, not arbitrary data write); no confidentiality or availability impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The WP Express Checkout WordPress plugin before 2.5.0 does not verify server-side that a payment was actually completed before marking an order as paid, allowing unauthenticated users to forge a completed order without paying.
AnalysisAI
Payment bypass in the WP Express Checkout WordPress plugin (versions before 2.5.0) allows unauthenticated users to forge completed order records without submitting actual payment. The plugin fails to perform server-side validation against the payment processor to confirm a transaction was successfully completed, trusting client-supplied signals instead. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions are required beyond the target WordPress site having an active WP Express Checkout plugin installation at a version below 2.5.0 with at least one product available for purchase. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) captures the technical vector accurately but significantly understates the business risk: any unauthenticated visitor can obtain paid goods or services at zero cost, causing direct merchant financial loss at scale with no authentication barrier. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update the WP Express Checkout plugin to version 2.5.0 or later immediately, as this version introduces the missing server-side payment verification. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Wp Express Checkout
View allPayment verification bypass in WP Express Checkout WordPress plugin before 2.4.9 allows unauthenticated remote attackers
The WP Express Checkout plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘pec_coupon[code]’ par
Share
External POC / Exploit Code
Leaving vuln.today