PT-2026-66698 · WordPress · Flxwoo
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
FlxWoo WordPress plugin versions prior to 3.1.1
Description
The plugin fails to verify with the payment processor whether a checkout session was actually paid before marking the associated order as paid. This allows unauthenticated attackers to complete WooCommerce orders without performing the required payment.
Recommendations
Update the FlxWoo WordPress plugin to version 3.1.1 or later.
Exploit
Fix
Improper Authentication
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Flxwoo