CVE-2026-14830 describes an improper authentication vulnerability in the FlxWoo WordPress plugin prior to version 3.1.1. The plugin fails to verify with the payment processor that a checkout session was actually paid before marking the associated WooCommerce order as paid. This allows unauthenticated attackers to bypass payment and complete orders fraudulently. The vulnerability is classified under CWE-287 (Improper Authentication) and has a CVSS v3.1 base score of 7.5, indicating a high severity due to its network attack vector, low complexity, no privileges required, and no user interaction needed. There is no vendor advisory or patch information available at this time, and no known exploits in the wild have been reported.

An attacker can complete WooCommerce orders without paying by exploiting the lack of verification with the payment processor. This leads to fraudulent order completion and potential financial loss for merchants using the affected FlxWoo plugin versions. The integrity of the payment process is compromised, but there is no direct impact on confidentiality or availability reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling the FlxWoo plugin or implementing additional manual verification steps for order payments to prevent fraudulent order completion.