WordPress Plugin Vulnerabilities

FlxWoo < 3.1.1 - Unauthenticated Payment Bypass

Description

The plugin does not verify with the payment processor that a checkout session was actually paid before marking the associated order as paid, allowing unauthenticated attackers to complete WooCommerce orders without paying.

Proof of Concept

Affects Plugins

Plugin icon
flx-woo
Fixed in 3.1.1

References

CVE
CVE-2026-14830

Classification

Type
AUTHBYPASS
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-287
CVSS
7.5 (high)

Miscellaneous

Original Researcher
Pedro Pinho
Submitter
Pedro Pinho
Verified
Yes
WPVDB ID
b866258c-b49b-40db-a0ff-6c0921b5c89f

Timeline

Publicly Published
2026-07-13 (about 18 days ago)
Added
2026-07-13 (about 17 days ago)
Last Updated
2026-07-13 (about 17 days ago)

Other

Published
Title
Published
2026-06-22
Title
Tutor LMS < 3.9.13 - Subscriber+ Unauthorized Course Enrollment and Private Course Content Disclosure via Droip/Kirki Integration
Published
2020-02-16
Title
ThemeGrill Demo Importer < 1.6.3 - Auth Bypass & Database Wipe
Published
2026-01-29
Title
Booked <= 3.0.0 - Authentication Bypass
Published
2025-10-15
Title
Ace User Management <= 2.0.3 - Subscriber+ Authentication Bypass via Password Rest
Published
2026-03-02
Title
All-in-One Microsoft 365 & Entra ID / Azure AD SSO Login < 2.2.6 - Authentication Bypass