Description

The WP Express Checkout WordPress plugin before 2.4.9 does not verify server-side that a payment was actually completed before marking an order as paid, allowing unauthenticated users to forge a completed order without paying.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-02T15:17:45.013Z",
  "pubdate": "2026-09-02T15:17:45.013Z",
  "executiveSummary": "The WP Express Checkout plugin prior to version 2.4.9 suffers from a critical improper input validation vulnerability that allows for payment verification bypass.\nThis vulnerability is classified as a missing server-side authorization check regarding payment status, which permits unauthenticated attackers to simulate successful transactions.\nBy manipulating the request parameters sent to the plugin's processing endpoints, an attacker can coerce the system into marking an order as 'paid' despite no actual funds being transferred.\nThe impact includes financial loss, unauthorized acquisition of goods or digital assets, and compromise of order management integrity.\nThis vulnerability is highly critical as it requires no prior authentication or administrative privileges to exploit.\nThe attack is performed over the network via standard HTTP requests and does not require complex infrastructure, making it an attractive target for automated exploitation.",
  "technicalDetails": "The root cause of this vulnerability lies in an insufficient implementation of server-side transactional validation within the WP Express Checkout payment processing flow.\nIn versions prior to 2.4.9, the plugin fails to perform a cryptographically secure verification or a callback validation (IPN/Webhook check) against the payment gateway's API before updating the order status in the WordPress database.\nThe vulnerability manifests because the plugin trusts client-supplied data to determine whether a payment transaction was successful.\nAn unauthenticated attacker can observe the structure of the requests sent to the payment processing endpoint. By crafting a forged HTTP request containing the parameters that the plugin expects upon a 'Success' notification from a payment provider, the attacker can trigger the plugin's internal order completion logic.\nThe exploitation flow proceeds as follows: First, the attacker initiates a legitimate checkout process to obtain necessary order identifiers or session data. Second, the attacker bypasses the actual payment gateway redirection or interaction. Third, the attacker manually constructs a POST or GET request that mimics the successful response expected by the plugin's listener function.\nBecause the server-side code does not query the payment provider to confirm the transaction status (e.g., using a transaction ID validation against a provider-signed object), it accepts the forged payload as authentic.\nUpon receipt of the malicious request, the plugin invokes the order fulfillment functions, changing the status of the order to 'Completed' or 'Paid' and potentially triggering downstream actions such as granting digital download access, changing order status in WooCommerce/other integrated plugins, or notifying the site administrator of a sale.\nThis behavior bypasses the fundamental requirement for financial verification, allowing the attacker to attain the results of a successful purchase without initiating or completing a real-world transaction.\nThe vulnerability is exposed via the network and requires no special privileges, as the listener endpoint is typically publicly accessible to accommodate asynchronous notifications from payment gateways. The exploitation process is highly reliable as it relies on logical deficiencies rather than race conditions or complex heap manipulation."
}