EUVD-2026-95708
GHSA-58v2-gc76-7w2f
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach public order confirmation endpoint
-
ExploitSend crafted request with target order params
-
ExecutionBypass missing capability/nonce/order-key check
-
ImpactAlter order status and recover order keys
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions beyond having the Livees Checkout plugin (version 7.0.2 or earlier) installed and its order confirmation page reachable - the endpoint acts on attacker-supplied request parameters without any capability, nonce, or order-key check, so remote unauthenticated exploitation works against default installs. The practical limit on impact is scope: an attacker must know or enumerate valid order identifiers, and the consequences are confined to order status manipulation, storing arbitrary data/notes, and recovering order keys (information disclosure), with no code execution, full site takeover, or availability impact. |
| Impact | Signals are moderately aligned toward a real but not top-tier priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated flaw with no user interaction, which is the easiest class to exploit, and publicly available exploit code (WPScan) lowers the barrier further. However, impact is capped at Low/Low/None - attackers can tamper with order status, write arbitrary notes/data, and recover order keys, but cannot fully compromise the site or cause denial of service, which is why the base score lands at 6.5 (Medium) rather than Critical. No EPSS score was provided in the input, so exploitation probability cannot be quantified here, and the vulnerability is NOT in CISA KEV, so there is no evidence of active in-the-wild exploitation despite the public POC - POC availability and active exploitation are distinct signals and should not be conflated. No SSVC decision data was supplied. Net: a genuinely easy-to-trigger access-control flaw worth prompt patching for affected sites, but the bounded integrity/confidentiality impact and niche plugin footprint keep it below the urgency of RCE or auth-bypass bugs. |
| Exploit ScenarioDerived | An unauthenticated attacker sends crafted requests to the plugin's order confirmation page endpoint, which acts on request parameters without any capability, nonce, or order-key validation. By iterating order identifiers, the attacker changes the status of arbitrary orders, writes arbitrary data and notes onto them, and recovers victims' order keys - exposing order information. A public POC from WPScan exists, making opportunistic exploitation straightforward. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 09, 2026
Unauthenticated attackers can manipulate arbitrary WooCommerce-style orders handled by the Livees Checkout WordPress plugin through version 7.0.2, because the order confirmation page processes request parameters without any capability, nonce, or order-key validation. This lets remote attackers change order statuses, inject arbitrary data and notes into orders, and recover order keys, degrading data integrity and leaking order information. Publicly available exploit code exists and WPScan has published the vulnerability, but there is no confirmed active exploitation (CISA KEV) at time of analysis; the assessed CVSS is 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N), with impact bounded by the need to know or enumerate valid order identifiers and no code execution or availability loss.
RemediationAI
No vendor-released patch version is identified in the provided data, so the primary action is to stop exposing the vulnerable code path: update or remove the Livees Checkout plugin using a version released after 7.0.2 if the vendor has published one (verify against the plugin's WordPress.org changelog or the WPScan entry at https://wpscan.com/vulnerability/c9730831-54a3-4307-94c9-e994337a943c/, since no fixed version is stated in the input). If no fixed release is available, deactivate and delete the plugin - this eliminates the risk outright but removes its checkout features from the storefront. As an interim compensating control, block unauthenticated HTTP access to the plugin's order confirmation endpoint (for example, via WAF rules or web-server/Nginx-Apache location blocks targeting the plugin's request paths and the order-affecting parameters), accepting that legitimate guest checkout confirmations may break; also enforce authentication or nonce/order-key checks at the front proxy where possible. Because the flaw also leaks order keys, treat order keys as compromised on affected sites: rotate or regenerate affected order keys, review orders for unauthorized status changes and injected notes, and audit logs for requests containing order identifiers from unauthenticated clients. Given that publicly available exploit code exists and the weakness requires no authentication or user interaction, prioritize patching or plugin removal on production shops despite the absence of confirmed active exploitation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerable component is the Livees Checkout WordPress plugin, which extends WordPress/WooCommerce checkout and order-confirmation functionality. Its order confirmation page handler lacks the standard WordPress security controls that would normally gate order-affecting operations: a capability check (current_user_can), a nonce check (check_admin_referer / wp_verify_nonce), and an order-key check that binds a request to a specific legitimate order. Because none of these are enforced and the endpoint is reachable through the normal web front end, any request parameters that influence order state (status transitions, stored metadata/notes, and order key retrieval) are honored for whatever order identifier is supplied. The CWE is not provided in the input, but the root cause class corresponds to missing authorization/authentication checks on a sensitive function (CWE-862/CWE-306 family) combined with exposure of a sensitive identifier (order key) to unauthenticated parties. The CPE supplied is cpe:2.3:a:unknown:livees_checkout:*:*:*:*:*:*:*:*, indicating the plugin entry is not fully attributed in the vendor namespace and that all versions up to and including 7.0.2 are in scope; because the endpoint requires no authentication (PR:N) and no user interaction (UI:N), the attack is a pure network-based request against a default installation.
Know when Livees Checkout gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Unauthenticated network endpoint with no interaction (AV:N/AC:L/PR:N/UI:N); order-key disclosure and order tampering give C:L/I:L, no availability impact (A:N).
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
DescriptionCVE.org
The Livees Checkout WordPress plugin through 7.0.2 does not perform any capability, nonce or order-key check before acting on request parameters on the order confirmation page, allowing unauthenticated users to change the status of arbitrary orders, store arbitrary data and notes on them, and recover their order keys.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB