Read the docs
TI-2026-85062 Aliases CVE-2026-121993GHSA-7whv-72vx-cc4j

wePOS missing authorization lets vendor staff mark orders paid

Priority LOW 24CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

wePOS (Point Of Sale for WooCommerce) from 1.2.6 before 2.0.3 contains a missing authorization flaw (CWE-862) in the wepos/v1/payment/process REST route. An authenticated user with only the publish_shop_orders capability, such as Dokan vendor staff, can supply another order's ID and mark that order as paid and completed without making a real payment. The order completion steps run, including stock reduction and granting paid-order access. The flaw is not listed in CISA KEV and no public exploit is referenced.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Description from the CNA

wePOS (Point Of Sale for WooCommerce) before 2.0.3 contains a missing authorization vulnerability in the wepos/v1/payment/process REST route that allows authenticated vendor-level users to mark arbitrary orders as paid and completed by supplying another order's ID. Attackers with only the publish_shop_orders capability (such as Dokan vendor staff) can invoke the payment processing endpoint with an order ID they do not own to trigger the order completion lifecycle, including stock reduction and granting of paid-order access, without making any real payment.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00245 15th percentileScored 2026-11-07
Fix Fixed wePOS – Point Of Sale (POS) for WooCommerce & Dokan (wedevs): 2.0.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
weDevswePOS – Point Of Sale (POS) for WooCommerce & Dokan1.2.6 to before 2.0.32.0.3Patch availableCNA
  • wePOS – Point Of Sale (POS) for WooCommerce & Dokan VendorweDevs Affected 1.2.6 to before 2.0.3 Fixed in 2.0.3 Patch available CNA

Remediation

Update wePOS to version 2.0.3, which fixes the flaw. The sources list no advisory identifier for this fix.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

  • Fix · CNA wePOS – Point Of Sale (POS) for WooCommerce & Dokan (wedevs) Fixed in 2.0.3

Timeline

  1. 2026-11-04 Threatist record created from CVE-2026-121993
  2. 2026-11-04 Alias added: GHSA-7whv-72vx-cc4j
  3. 2026-11-04 CISA SSVC decision points changed

References

Patch 2

Other 2

  • TI-2021-06932 WP User Frontend < 3.5.29 - Obscure Registration as Admin CVSS 3.1CRITICAL 9.8
  • TI-2024-03660 Dokan Pro <= 3.10.3 - Unauthenticated SQL Injection CVSS 3.1CRITICAL 10.0
  • TI-2024-11873 WP ERP < 1.13.4 - Custom+ Unauthorized Access to Terminated Employee Information CVSS 3.1HIGH 7.5
  • TI-2024-11148 SQL Injection in WordPress Project Manager Plugin CVSS 3.1HIGH 7.7
  • TI-2023-02570 WP ERP < 1.12.4 - Admin+ SQL Injection CVSS 3.1HIGH 7.2
  • TI-2023-02569 WP ERP < 1.12.4 - Reflected Cross-Site Scripting CVSS 3.1MEDIUM 6.1
See all 144 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences