CVE-2026-83533: CWE-345 Insufficient Verification of Data Authenticity in WP Express Checkout

The WP Express Checkout WordPress plugin prior to version 2.4.9 fails to perform server-side verification to confirm that a payment transaction was actually completed before marking an order as paid. This flaw enables unauthenticated attackers to forge completed orders, bypassing payment requirements. The vulnerability is identified as CWE-345 and has a CVSS 3.1 base score of 5.3, indicating a medium severity impact primarily affecting integrity. No official patch or remediation guidance is currently provided, and no known exploits are reported in the wild.

An attacker can create forged orders marked as paid without completing any payment, potentially causing financial loss or disruption to the merchant's order processing. The integrity of the payment and order system is compromised, but confidentiality and availability are not affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling the plugin or restricting access to the checkout functionality to trusted users only. Monitor for vendor updates regarding a security patch.