CVE-2026-86851

The Livees Checkout WordPress plugin, affecting versions up to 7.0.2 , contains a vulnerability where it fails to perform necessary capability, nonce, or order-key checks on the order confirmation page. This flaw allows unauthenticated users to manipulate request parameters to change the status o...

CVE-2026-86851 Livees Checkout 6.8 - 7.0.2 - Unauthenticated Order Status Change, Order Note Injection & Order Key Disclosure

The Livees Checkout WordPress plugin through 7.0.2 does not perform any capability, nonce or order-key check before acting on request parameters on the order confirmation page, allowing unauthenticated users to change the status of arbitrary orders, store arbitrary data and notes on them, and...