WordPress WP Express Checkout plugin < 2.4.9 - Unauthenticated Payment Bypass via wpec_process_payment vulnerability

Unauthenticated Payment Bypass via wpecprocesspayment vulnerability discovered by Amity Gilmour in WordPress Plugin WP Express Checkout Accept PayPal Payments versions 2.4.9...

CVE-2026-83533

WP Express Checkout WordPress plugin before 2.4.9 contains an unauthenticated payment bypass in the wpec_process_payment handler. The plugin does not verify server-side that a payment was actually completed before marking an order as paid, allowing unauthenticated users to forge a completed order...

CVE-2026-83533 WP Express Checkout < 2.4.9 - Unauthenticated Payment Bypass via wpec_process_payment

The WP Express Checkout WordPress plugin before 2.4.9 does not verify server-side that a payment was actually completed before marking an order as paid, allowing unauthenticated users to forge a completed order without paying...