A missing authorization vulnerability exists in wePOS for WooCommerce & Dokan versions 1.2.6 up to but not including 2.0.3. Authenticated users with vendor-level privileges can exploit the wepos/v1/payment/process REST route to mark arbitrary orders as paid and completed without actual payment. This allows unauthorized order completion, including stock reduction and granting paid-order access. The issue is fixed in version 2.0.3.