# Woo Billingo Plus <= 5.4 - Unauthenticated VAT Number Validation Bypass via Block Checkout

- **ID:** WPSEC-2026-2521
- **Plugin:** Woo Billingo Plus (`woo-billingo-plus`), https://wordpress.org/plugins/woo-billingo-plus/
- **Affected versions:** all versions before 5.4.1
- **Fixed in:** 5.4.1 (Update to 5.4.1 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-20
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-11-04)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/woo-billingo-plus
- **Fix released:** 2026-11-03
- **Published:** 2026-11-04
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2521/

## Description

The Enhanced Integration for Billingo and WooCommerce (woo-billingo-plus) plugin for WordPress is vulnerable to a VAT number validation bypass in all versions up to, and including, 5.4 due to the block checkout reusing a validation result stored in the WooCommerce session without verifying it belongs to the submitted VAT number, and not rejecting malformed VAT numbers. This makes it possible for unauthenticated attackers to validate one legitimate VAT number and then check out with a different or invalid VAT number that is treated as valid, potentially obtaining company/VAT-exempt treatment on their orders.

## References

- https://wpsec.com/vuln/WPSEC-2026-2521/
- https://plugins.svn.wordpress.org/woo-billingo-plus/tags/5.4.1/
- https://wordpress.org/plugins/woo-billingo-plus/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2521/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.