Skip to content
Sign in
5.3 Medium

CVE-2026-83533 The WP Express Checkout WordPress plugin before 2.4.9 does not verify server-side that a payment was actually…

Description

The WP Express Checkout WordPress plugin before 2.4.9 does not verify server-side that a payment was actually completed before marking an order as paid, allowing unauthenticated users to forge a completed order without paying.

Affected products and versions

Product Affected versions Fixed in
WP Express Checkout 2.4 earliest → < 2.4.9 2.4.9

Other CVEs of WP Express Checkout

The 2 CVEs of WP Express Checkout →
CVE-2026-83537 The WP Express Checkout WordPress plugin before 2.5.0 does not verify server-side that a payment was actually… 5.3 Medium
Track this CVE