Amity Gilmour

**Name of the Vulnerable Software and Affected Versions** WP Express Checkout versions prior to 2.4.9 **Description** Unauthenticated users can forge a completed order without making a payment because the software fails to verify server-side that a payment was actually completed before marking an order as paid. This issue occurs within the `wpec process payment()` function. **Recommendations** Update WP Express Checkout to version 2.4.9 or later.

**Name of the Vulnerable Software and Affected Versions** WP Fastest Cache versions 0.8.7.7 through 1.5.0 **Description** An issue exists where the plugin fails to include specific tracking-related query parameters in its page-cache key while continuing to cache pages requested with those parameters. This allows unauthenticated attackers to perform cache poisoning by forcing a page rendered under their own request context to be stored and served from the clean URL cache entry to all subsequent visitors. **Recommendations** Update WP Fastest Cache to version 1.5.1 or later.