Medium severity5.3NVD Advisory· Published Sep 2, 2026· Updated Sep 3, 2026
CVE-2026-83533
CVE-2026-83533
Description
The WP Express Checkout WordPress plugin before 2.4.9 does not verify server-side that a payment was actually completed before marking an order as paid, allowing unauthenticated users to forge a completed order without paying.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1- Range: <2.4.9
Patches
Vulnerability mechanics
References
1News mentions
2- Wordfence Intelligence Weekly WordPress Vulnerability Report (August 31, 2026 to September 6, 2026)Wordfence Blog · Sep 10, 2026
- WordPress Plugins: 24 Vulnerabilities Disclosed, Including Two Critical FlawsVypr Intelligence · Sep 2, 2026