Woo Billingo Plus <= 5.4 - Unauthenticated VAT Number Validation Bypass via Block Checkout
- ID
- WPSEC-2026-2521
- Plugin
- Woo Billingo Plus (woo-billingo-plus)
- Affected
- all versions before 5.4.1
- Remediation
- Update to 5.4.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-20
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-11-04
- Attack surface
- Woo Billingo Plus on WPSec AttackSurface
- Fix released
- Published
Description
The Enhanced Integration for Billingo and WooCommerce (woo-billingo-plus) plugin for WordPress is vulnerable to a VAT number validation bypass in all versions up to, and including, 5.4 due to the block checkout reusing a validation result stored in the WooCommerce session without verifying it belongs to the submitted VAT number, and not rejecting malformed VAT numbers. This makes it possible for unauthenticated attackers to validate one legitimate VAT number and then check out with a different or invalid VAT number that is treated as valid, potentially obtaining company/VAT-exempt treatment on their orders.
References
- https://wpsec.com/vuln/WPSEC-2026-2521/
- https://plugins.svn.wordpress.org/woo-billingo-plus/tags/5.4.1/
- https://wordpress.org/plugins/woo-billingo-plus/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS