CVE-2026-83537

MediumCVSS 5.3

Published: 09/09/2026(UTC)Updated: 09/09/2026(UTC)Translated: 09/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.11%

2th percentile - higher than 2% of all known CVEs

Summary

The WP Express Checkout WordPress plugin before version 2.5.0 does not verify server-side that a payment was actually completed before marking an order as paid, allowing unauthenticated users to forge a completed order without paying.

Risk Assessment

The organization may suffer financial losses due to fraudulent orders marked as paid. This could also lead to shipping goods or providing services without receiving payment.

Recommendation

Update the WP Express Checkout plugin to version 2.5.0 or later. Also implement additional server-side payment verification mechanisms.

Other vulnerabilities in WP Express Checkout

CVE-2026-96818High
WP Express Checkout (Accept PayPal Payments) plugin in versions up to and including 2.4.9 contains a Broken Access Control vulnerability. It can be exploited by an unauthenticated attacker.

Original NVD description (English source)

The WP Express Checkout WordPress plugin before 2.5.0 does not verify server-side that a payment was actually completed before marking an order as paid, allowing unauthenticated users to forge a completed order without paying.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS