The FlxWoo WordPress plugin prior to version 3.1.1 fails to verify that a checkout session is actually completed before marking the related WooCommerce order as paid, allowing an attacker to complete orders without submitting payment. This flaw effectively removes the core security check that ensures payment has been processed, resulting in loss of revenue and potential fraud.

Any WordPress site that installs the FlxWoo plugin at a version earlier than 3.1.1 is affected. No other vendors or products were listed. Site owners should verify the plugin version and ensure the upgrade path is followed if the site is vulnerable.

The vulnerability can be exploited remotely by an unauthenticated actor, who can send crafted requests to the plugin’s payment checkout endpoints to trick the system into marking an order as paid. The EPSS score of 0.208% indicates a low but real chance of exploitation, and the CVSS score of 7.5 denotes high severity. The issue is not listed in the CISA KEV catalog, but the impact level is significant enough to warrant immediate attention. The attack vector likely involves direct HTTP requests to the checkout handling logic of the plugin, bypassing any server‑side payment validation.