{
 "id": "WPSEC-2026-2521",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2521/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2521/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2521/index.md",
 "title": "Woo Billingo Plus <= 5.4 - Unauthenticated VAT Number Validation Bypass via Block Checkout",
 "description": "The Enhanced Integration for Billingo and WooCommerce (woo-billingo-plus) plugin for WordPress is vulnerable to a VAT number validation bypass in all versions up to, and including, 5.4 due to the block checkout reusing a validation result stored in the WooCommerce session without verifying it belongs to the submitted VAT number, and not rejecting malformed VAT numbers. This makes it possible for unauthenticated attackers to validate one legitimate VAT number and then check out with a different or invalid VAT number that is treated as valid, potentially obtaining company/VAT-exempt treatment on their orders.",
 "plugin": {
  "slug": "woo-billingo-plus",
  "name": "Woo Billingo Plus",
  "full_name": "Woo Billingo Plus",
  "wordpress_org": "https://wordpress.org/plugins/woo-billingo-plus/",
  "advisories_url": "https://wpsec.com/vuln/plugin/woo-billingo-plus/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/woo-billingo-plus"
 },
 "type": "BYPASS",
 "cwe": [
  "CWE-20"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "5.4.1",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 5.4.1"
  ]
 },
 "introduced_in": null,
 "fixed_in": "5.4.1",
 "remediation": "Update to 5.4.1 or later.",
 "fix_released": "2026-11-03T18:22:07+00:00",
 "published": "2026-11-04T18:43:27+00:00",
 "updated": "2026-11-04T14:28:41.634060+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2521/",
  "https://plugins.svn.wordpress.org/woo-billingo-plus/tags/5.4.1/",
  "https://wordpress.org/plugins/woo-billingo-plus/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/woo-billingo-plus",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-11-04"
 }
}