CVE-2026-121993 in wePOS Plugin
Summary
by MITRE • 11/04/2026
wePOS (Point Of Sale for WooCommerce) before 2.0.3 contains a missing authorization vulnerability in the wepos/v1/payment/process REST route that allows authenticated vendor-level users to mark arbitrary orders as paid and completed by supplying another order's ID. Attackers with only the publish_shop_orders capability (such as Dokan vendor staff) can invoke the payment processing endpoint with an order ID they do not own to trigger the order completion lifecycle, including stock reduction and granting of paid-order access, without making any real payment.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 11/04/2026
The vulnerability identified in wePOS versions prior to 2.0.3 represents a critical failure in server-side authorization controls within the Point Of Sale interface for WooCommerce. Specifically, the REST API endpoint located at wepos/v1/payment/process lacks proper validation of ownership or administrative privileges relative to the order being processed. This architectural flaw allows any authenticated user possessing the publish_shop_orders capability, which is commonly assigned to vendor-level staff in multi-vendor marketplace setups such as Dokan, to manipulate the state of arbitrary orders within the system. The core technical issue lies in the absence of a check that verifies whether the initiating user has permission to modify or finalize the specific order ID provided in the request payload. Instead of validating ownership against the authenticated session's permissions, the endpoint blindly accepts the order identifier and proceeds with the associated business logic, treating any validly formatted order ID as if it were authorized for processing by the caller.
From an operational perspective, this vulnerability enables a severe integrity compromise where attackers can artificially mark orders as paid and completed without executing any actual financial transaction. When the malicious request is processed, the system triggers the full order completion lifecycle, which includes critical side effects such as reducing inventory stock levels to reflect the sale and granting customers access to digital products or restricted content associated with that purchase. This means an attacker can effectively steal merchandise by causing stock deductions while simultaneously allowing unauthorized users to download paid goods without payment. The impact extends beyond immediate financial loss; it corrupts sales data, distorts inventory management systems, and undermines trust in the marketplace's transactional integrity. Since this requires only low-level permissions like publish_shop_orders, which are often granted broadly to vendor staff for operational efficiency, the attack surface is significantly expanded compared to vulnerabilities requiring administrator access.
This flaw aligns with CWE-862, Missing Authorization, as it involves a failure to enforce proper access control policies on sensitive actions. Furthermore, in the context of the MITRE ATT&CK framework, this behavior corresponds to techniques involving Account Manipulation and Data Exfiltration through unauthorized system state changes. The attacker leverages legitimate credentials with limited privileges to perform high-impact administrative functions that should be restricted to higher-level roles or strictly scoped to owned resources. Such vulnerabilities are particularly dangerous in e-commerce environments because they allow for the exploitation of business logic rather than just technical code errors, making them difficult to detect through standard input validation checks alone.
To mitigate this vulnerability, immediate action is required by upgrading wePOS to version 2.0.3 or later where these authorization checks have been implemented. In the interim, administrators should restrict the publish_shop_orders capability for vendor staff who do not require it for their specific operational roles, thereby limiting the pool of users capable of invoking the vulnerable endpoint. Additionally, implementing strict server-side validation that cross-references the order ID with the authenticated user's permitted scope is essential. Security monitoring tools should be configured to alert on unusual patterns of order status changes initiated by non-administrative accounts, particularly those involving rapid stock reductions or digital product access grants without corresponding payment gateway logs. Regular audits of role-based access control configurations are also recommended to ensure that permissions align with the principle of least privilege across all integrated marketplace plugins.