Missing Authorization Vulnerability in wePOS Point of Sale for WooCommerce by Dokan

CVE-2026-121993

What is CVE-2026-121993?

The wePOS Point of Sale for WooCommerce prior to version 2.0.3 is susceptible to a missing authorization flaw in its payment processing endpoint. This vulnerability permits authenticated users with vendor-level permissions, such as those with the publish_shop_orders capability, to manipulate order statuses unauthorizedly. Specifically, attackers can exploit this weakness by submitting an order ID that does not belong to them, allowing them to set arbitrary orders as paid and mark them as completed without processing a legitimate payment. This leads to unintended stock reduction and unauthorized access to paid-order features, thereby posing significant risks to online stores utilizing this plugin.

References