CVE-2026-86851

Name of the Vulnerable Software and Affected Versions Livees Checkout WordPress plugin versions prior to 7.0.3

Description The order confirmation page fails to perform capability, nonce, or order-key checks before processing request parameters. This allows unauthenticated users to modify the status of arbitrary orders, store arbitrary data and notes on those orders, and recover order keys. A nonce is a unique token used to prevent replay attacks by ensuring a request is intentional and unique.

Recommendations Update the Livees Checkout WordPress plugin to version 7.0.3 or later.