Is CVE-2026-83533 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-83533?

CVE-2026-83533 has a CVSS v3 severity of MEDIUM (5.3).

Back

CVE-2026-83533

Description

The WP Express Checkout WordPress plugin before 2.4.9 does not verify server-side that a payment was actually completed before marking an order as paid, allowing unauthenticated users to forge a completed order without paying.