WordPress Plugin Vulnerabilities

WP Express Checkout < 2.4.9 - Unauthenticated Payment Bypass via wpec_process_payment

Description

The plugin does not verify server-side that a payment was actually completed before marking an order as paid, allowing unauthenticated users to forge a completed order without paying.

Proof of Concept

Affects Plugins

Plugin icon
wp-express-checkout
Fixed in 2.4.9

References

CVE
CVE-2026-83533

Miscellaneous

Original Researcher
Amity Gilmour
Submitter
Amity Gilmour
Verified
Yes
WPVDB ID
8ffb76d6-fda5-4819-ab07-d8c086169110

Timeline

Publicly Published
2026-09-01 (about 1 day ago)
Added
2026-09-01 (about 1 day ago)
Last Updated
2026-09-01 (about 1 day ago)

Other

Published
Title
Published
2017-01-26
Title
WordPress 4.2.0-4.7.1 - Press This UI Available to Unauthorised Users
Published
2026-08-06
Title
Estatik Real Estate Plugin < 4.3.4 - Unauthenticated Arbitrary-Recipient Mail Relay via Signed-Value Mismatch
Published
2024-08-30
Title
IP Vault – WP Firewall < 2.1 - IP Address Spoofing to Protection Mechanism Bypass
Published
2025-09-19
Title
WP Private Content Plus <= 3.6.2 - Password Protection Bypass
Published
2015-02-26
Title
EasyCart 1.1.30 - 3.0.20 - Privilege Escalation