CVE-2026-86851 in Livees Checkout Plugin
Summary
by MITRE • 10/09/2026
The Livees Checkout WordPress plugin through 7.0.2 does not perform any capability, nonce or order-key check before acting on request parameters on the order confirmation page, allowing unauthenticated users to change the status of arbitrary orders, store arbitrary data and notes on them, and recover their order keys.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/09/2026
The vulnerability identified in Livees Checkout WordPress plugin versions through 7.0.2 represents a critical failure in access control mechanisms within an e-commerce environment. This flaw is fundamentally rooted in the absence of proper validation for incoming HTTP requests targeting the order confirmation page. Specifically, the application fails to verify user capabilities, validate nonces, or check order keys before processing parameters that modify order data. In secure web applications, especially those handling sensitive financial transactions and personal customer information, it is imperative to enforce strict authentication and authorization checks. The lack of these safeguards allows unauthenticated actors to interact with backend logic intended for authenticated administrators or legitimate customers, thereby bypassing the security perimeter entirely.
From a technical perspective, this vulnerability aligns closely with CWE-284 Improper Access Control and CWE-352 Cross-Site Request Forgery (CSRF). The absence of nonce validation means that any maliciously crafted request can be executed by a victim user if they are tricked into visiting a specific URL or clicking a link, although the severity is amplified here because no authentication is required at all. This effectively renders the application vulnerable to unauthenticated state changes. An attacker does not need valid credentials to exploit this flaw; instead, they only need to construct HTTP requests with specific parameters that dictate the desired outcome for an arbitrary order ID known or guessed by the attacker.
The operational impact of this vulnerability is severe and multifaceted. First, attackers can arbitrarily change the status of orders, such as marking them as completed, refunded, or cancelled without authorization. This manipulation disrupts business operations, potentially leading to financial losses through fraudulent refunds or inventory discrepancies where stock levels are updated incorrectly based on false order statuses. Second, the ability to store arbitrary data and notes on orders allows attackers to inject malicious content into the database associated with customer records. While this may not directly expose passwords, it compromises data integrity and can be used for further attacks such as stored cross-site scripting if those notes are rendered unsanitized in administrative interfaces or email notifications sent to customers.
Furthermore, the capability to recover order keys is particularly dangerous because these keys often serve as secondary authentication tokens or unique identifiers that link a customer to their purchase history. If an attacker can retrieve these keys for arbitrary orders, they may be able to access sensitive information associated with those transactions, such as shipping addresses and partial payment details, depending on how the plugin displays this data in subsequent views. This constitutes a significant breach of confidentiality and privacy, violating standards like GDPR or CCPA if personal identifiable information is exposed without consent.
To mitigate this vulnerability, immediate action must be taken by updating the Livees Checkout WordPress plugin to version 7.0.3 or later where these checks have presumably been implemented. For organizations unable to update immediately due to compatibility concerns with other plugins, a temporary workaround involves restricting access to the affected endpoints via web application firewall rules that block unauthenticated POST requests targeting specific action parameters associated with order management. Additionally, implementing strict input validation and output encoding on all user-supplied data can help reduce the risk of secondary vulnerabilities such as SQL injection or cross-site scripting that might arise from storing arbitrary notes. Regular security audits focusing on access control logic are recommended to ensure that future updates do not reintroduce similar flaws in other parts of the e-commerce stack.