Wp Express Checkout
Monthly
Payment bypass in the WP Express Checkout WordPress plugin (versions before 2.5.0) allows unauthenticated users to forge completed order records without submitting actual payment. The plugin fails to perform server-side validation against the payment processor to confirm a transaction was successfully completed, trusting client-supplied signals instead. Any visitor to an affected WordPress store can obtain goods or services for free, making this a high-impact business-logic flaw despite its moderate CVSS score. A publicly available exploit exists via WPScan, and no public exploitation (KEV) has been confirmed at time of analysis.
Payment verification bypass in WP Express Checkout WordPress plugin before 2.4.9 allows unauthenticated remote attackers to forge completed orders without submitting actual payment. The plugin fails to perform server-side confirmation that a payment transaction was successfully processed before transitioning an order to 'paid' status, enabling fraudulent order completion. A publicly available exploit exists per WPScan, making active abuse by financially motivated actors a realistic near-term risk for any e-commerce site running an affected version.
The WP Express Checkout plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘pec_coupon[code]’ parameter in versions up to, and including, 2.2.8 due to insufficient input. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity.
Payment bypass in the WP Express Checkout WordPress plugin (versions before 2.5.0) allows unauthenticated users to forge completed order records without submitting actual payment. The plugin fails to perform server-side validation against the payment processor to confirm a transaction was successfully completed, trusting client-supplied signals instead. Any visitor to an affected WordPress store can obtain goods or services for free, making this a high-impact business-logic flaw despite its moderate CVSS score. A publicly available exploit exists via WPScan, and no public exploitation (KEV) has been confirmed at time of analysis.
Payment verification bypass in WP Express Checkout WordPress plugin before 2.4.9 allows unauthenticated remote attackers to forge completed orders without submitting actual payment. The plugin fails to perform server-side confirmation that a payment transaction was successfully processed before transitioning an order to 'paid' status, enabling fraudulent order completion. A publicly available exploit exists per WPScan, making active abuse by financially motivated actors a realistic near-term risk for any e-commerce site running an affected version.
The WP Express Checkout plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘pec_coupon[code]’ parameter in versions up to, and including, 2.2.8 due to insufficient input. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity.