CVE-2026-96818

HighCVSS 7.5

Published: 30/09/2026(UTC)Updated: 30/09/2026(UTC)Translated: 30/09/2026(UTC)NVD NIST

Summary

WP Express Checkout (Accept PayPal Payments) plugin in versions up to and including 2.4.9 contains a Broken Access Control vulnerability. It can be exploited by an unauthenticated attacker.

Risk Assessment

An unauthenticated attacker can bypass access control mechanisms and perform unauthorized operations, potentially compromising site security.

Recommendation

Update the WP Express Checkout plugin to a version newer than 2.4.9. Verify permissions and access logs after the update.

Other vulnerabilities in WP Express Checkout

CVE-2026-83537Medium
The WP Express Checkout WordPress plugin before version 2.5.0 does not verify server-side that a payment was actually completed before marking an order as paid, allowing unauthenticated users to forge a completed order without paying.

Original NVD description (English source)

Unauthenticated Broken Access Control in WP Express Checkout (Accept PayPal Payments) <= 2.4.9 versions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS