CVE-2026-83537: CWE-345 Insufficient Verification of Data Authenticity in WP Express Checkout

CVE-2026-83537 affects WP Express Checkout WordPress plugin versions prior to 2.5.0. The vulnerability arises because the plugin fails to verify on the server side that a payment transaction was actually completed before marking an order as paid. This insufficient verification of data authenticity (CWE-345) allows unauthenticated attackers to forge completed orders without paying. The CVSS 3.1 vector indicates the attack requires no privileges or user interaction and can be performed remotely over the network. There is no indication of an official fix or patch as of the published date.

An attacker can create forged completed orders without paying, impacting the integrity of order data. There is no direct impact on confidentiality or availability. This could lead to financial loss or fraud for merchants using the affected plugin versions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling the plugin or implementing additional server-side verification of payment completion. Monitoring for suspicious order activity may help detect exploitation attempts.