high7.5
CVE-2026-14830
The FlxWoo WordPress plugin before 3.1.1 does not verify with the payment processor that a checkout session was actually paid before marking the associated ord…
Impact
The FlxWoo WordPress plugin before 3.1.1 does not verify with the payment processor that a checkout session was actually paid before marking the associated order as paid, allowing unauthenticated attackers to complete WooCommerce orders without paying.
Affected products
| Product | Affected versions |
|---|---|
| FlxWoo WordPress Plugin | before 3.1.1 |
Versions were read from the advisory text. No structured product data has been published for this record yet.