The WP Express Checkout WordPress plugin before version 2.4.9 fails to perform a server‑side check that a payment has actually been completed before marking an order as paid. This allows a non‑authenticated user to forge a completed order by submitting the wpec_process_payment request. The result is that a shop can record a sale that never happened, leading to revenue loss, false inventory records, and potential credibility damage. The weakness is a classic Missing Mandatory Execution Flow (CWE‑345).

The vulnerability affects installations of the WP Express Checkout plugin on WordPress sites running any version earlier than 2.4.9. No specific vendors or operating systems are mentioned; the plugin is identified only as Unknown:WP Express Checkout. Users should verify the exact plugin version through the WordPress plugin list.

The CVSS score of 5.3 places the issue in the medium risk range. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, indicating it is not currently a known exploited target. The likely attack vector is a simple web request to the wpec_process_payment endpoint, which is reachable by any visitor. Because no authentication is required, the exploitation is trivial and carries no prerequisites beyond the existence of the vulnerable plugin on a live site. The combination of medium severity, low documented exploitation likelihood, and lack of KEV listing suggests a moderate overall risk that should be remediated promptly.