Description
The Livees Checkout WordPress plugin through 7.0.2 does not perform any capability, nonce or order-key check before acting on request parameters on the order confirmation page, allowing unauthenticated users to change the status of arbitrary orders, store arbitrary data and notes on them, and recover their order keys.
Published: 2026-10-09
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthenticated order manipulation and information disclosure
Action: Immediate Patch
AI Analysis

Impact

The Livees Checkout WordPress plugin lacks a capability, nonce, or order‑key check before processing requests on the order confirmation page, allowing an unauthenticated attacker to alter the status of any order, insert arbitrary notes, and recover order keys, potentially leading to financial loss or data compromise.

Affected Systems

The vulnerability affects Livees Checkout plugin versions 6.8 through 7.0.2 installed on WordPress sites.

Risk and Exploitability

The CVSS score of 6.5 indicates a medium severity vulnerability, and with authentication checks missing the risk of exploitation is high. No EPSS score is currently available, and the vulnerability is not listed in the CISA KEV catalog, yet an attacker can manipulate orders simply by sending crafted requests to the order confirmation URL. The likelihood of exploitation is therefore inferred to be significant due to the straightforward attack surface.

Generated by OpenCVE AI on October 9, 2026 at 18:39 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Livees Checkout to a patched version (7.0.3 or newer).
  • If an immediate upgrade is not possible, restrict access to the order confirmation page to authenticated users only, for example by applying role‑based access control or disabling public order status endpoints.
  • Deploy a web application firewall rule or security plugin configuration that blocks unauthorized status change parameters on the order confirmation request.

Generated by OpenCVE AI on October 9, 2026 at 18:39 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 09 Oct 2026 17:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-200
CWE-284

Fri, 09 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-862
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 09 Oct 2026 13:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-200
CWE-284

Fri, 09 Oct 2026 11:30:00 +0000

Type Values Removed Values Added
Description The Livees Checkout WordPress plugin through 7.0.2 does not perform any capability, nonce or order-key check before acting on request parameters on the order confirmation page, allowing unauthenticated users to change the status of arbitrary orders, store arbitrary data and notes on them, and recover their order keys.
Title Livees Checkout 6.8 - 7.0.2 - Unauthenticated Order Status Change, Order Note Injection & Order Key Disclosure
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: WPScan

Published:

Updated: 2026-10-09T15:00:19.018Z

Reserved: 2026-09-08T14:58:01.540Z

Link: CVE-2026-86851

cve-icon Vulnrichment

Updated: 2026-10-09T14:50:24.361Z

cve-icon NVD

Status : Deferred

Published: 2026-10-09T12:17:12.737

Modified: 2026-10-09T15:17:18.657

Link: CVE-2026-86851

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-09T18:45:10Z

Weaknesses