5.3
Moyenne
CVE-2026-83537 The WP Express Checkout WordPress plugin before 2.5.0 does not verify server-side that a payment was actually…
Description
The WP Express Checkout WordPress plugin before 2.5.0 does not verify server-side that a payment was actually completed before marking an order as paid, allowing unauthenticated users to forge a completed order without paying.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| WP Express Checkout 2.5 | premières → < 2.5.0 | 2.5.0 |