CVE-2026-121993 · Package
NO FIX YET · SEE WHAT TO DO
wePOS, a point-of-sale plugin for WooCommerce, has a REST route that does not check order ownership. An authenticated vendor-level user can mark another order as paid and completed without a real payment, triggering stock reduction and paid-order access.
first public Nov 4, 2026 · 1 source
Is this in your stack? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Sites running wePOS before 2.0.3 with multi-vendor roles that hold the publish_shop_orders capability, such as Dokan vendor staff. Sites without wePOS or without vendor-level accounts are not exposed through this route.
Not affected if no-vendor-roles, single-admin-store, wepos-2.0.3-or-later
Who cares dokan, wepos, woocommerce, wordpress
2.0.3 are affected.publish_shop_orders capability to vendor staff.2.0.3 or later.wePOS (Point Of Sale for WooCommerce) before 2.0.3 contains a missing authorization vulnerability in the wepos/v1/payment/process REST route that allows authenticated vendor-level users to mark arbitrary orders as paid and completed by supplying another order's ID. Attackers with only the publish_shop_orders capability (such as Dokan vendor staff) can invoke the payment processing endpoint with an order ID they do not own to trigger the order completion lifecycle, including stock reduction and granting of paid-order access, without making any real payment.
This page as .md · .json · in your agent: get_signal("CVE-2026-121993") · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.