CVE-2026-83533

EUVD-2026-70046 · Published Sep 2, 2026

The WP Express Checkout WordPress plugin before 2.4.9 does not verify server-side that a payment was actually completed before marking an order as paid, allowing unauthenticated users to forge a completed order without paying.

Weaknesses

CWE-345

CVSS scores

v3.15.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

MITRE ATT&CK

Inferred

Where this vulnerability fits in an attack

ReconImpact

Resource Development Initial Access Persistence Stealth Defense Impairment Credential Access Collection Impact

T1190Exploit Public-Facing Application T1211Exploitation for Stealth T1491Defacement T1542.002Component Firmware T1556Modify Authentication Process T1557.002ARP Cache Poisoning T1584.002DNS Server

References

https://wpscan.com/vulnerability/8ffb76d6-fda5-4819-ab07-d8c086169110/

Potentially impacted assets

See if this affects your attack surface