# Pre-Orders for WooCommerce <= 2.3.1 - Unauthenticated Payment Bypass via Pre-Order Status Transition

- **ID:** WPSEC-2026-2910
- **Plugin:** Pre-Orders for WooCommerce (`pre-orders-for-woocommerce`), https://wordpress.org/plugins/pre-orders-for-woocommerce/
- **Affected versions:** from 1.2.13 before 2.3.2
- **Fixed in:** 2.3.2 (Update to 2.3.2 or later.)
- **Severity:** Low 3.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-841
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-12)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/pre-orders-for-woocommerce
- **Fix released:** 2026-11-10
- **Published:** 2026-11-12
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2910/

## Description

The Pre-Orders for WooCommerce plugin for WordPress is vulnerable to a Payment Bypass via the scheduled pre-order status transition in all versions up to, and including, 2.3.1, due to the checkForPreOrders() sync routine using the return value of payment_complete(), which is always true for orders already in the pre-ordered status, rather than checking whether the order was paid. Cash on Delivery orders that contain a pre-order date are placed in the pre-ordered status without payment. This makes it possible for unauthenticated attackers to have an unpaid Cash on Delivery pre-order automatically marked as completed (and paid) once its pre-order date passes, for example gaining access to downloadable products without paying. The site must have Cash on Delivery enabled.

## References

- https://wpsec.com/vuln/WPSEC-2026-2910/
- https://plugins.svn.wordpress.org/pre-orders-for-woocommerce/tags/2.3.2/
- https://wordpress.org/plugins/pre-orders-for-woocommerce/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2910/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.