Pre-Orders for WooCommerce <= 2.3.1 - Unauthenticated Payment Bypass via Pre-Order Status Transition
- ID
- WPSEC-2026-2910
- Plugin
- Pre-Orders for WooCommerce (pre-orders-for-woocommerce)
- Affected
- from 1.2.13 before 2.3.2
- Remediation
- Update to 2.3.2 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-841
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-12
- Attack surface
- Pre-Orders for WooCommerce on WPSec AttackSurface
- Fix released
- Published
Description
The Pre-Orders for WooCommerce plugin for WordPress is vulnerable to a Payment Bypass via the scheduled pre-order status transition in all versions up to, and including, 2.3.1, due to the checkForPreOrders() sync routine using the return value of payment_complete(), which is always true for orders already in the pre-ordered status, rather than checking whether the order was paid. Cash on Delivery orders that contain a pre-order date are placed in the pre-ordered status without payment. This makes it possible for unauthenticated attackers to have an unpaid Cash on Delivery pre-order automatically marked as completed (and paid) once its pre-order date passes, for example gaining access to downloadable products without paying. The site must have Cash on Delivery enabled.
References
- https://wpsec.com/vuln/WPSEC-2026-2910/
- https://plugins.svn.wordpress.org/pre-orders-for-woocommerce/tags/2.3.2/
- https://wordpress.org/plugins/pre-orders-for-woocommerce/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS