CVE-2026-83533

The WP Express Checkout plugin for WordPress prior to version 2.4.9 is vulnerable as it fails to verify payment completion on the server side, enabling unauthenticated users to falsely mark orders as paid. This could lead to unauthorized access to products or services without actual payment, posing a risk to e-commerce operations. WordPress site administrators using this plugin should prioritize updating to the latest version to mitigate potential financial losses and maintain transaction integrity.