Executive brief
The FlxWoo plugin for WordPress, which integrates mobile app functionality with WooCommerce stores, contains a flaw that allows customers to bypass the payment process. An attacker can trick the system into marking an order as paid without actually completing a transaction with the payment provider. This could lead to significant financial loss as digital or physical goods could be shipped or granted without valid payment.
Technical details
The FlxWoo plugin suffers from an authentication bypass vulnerability (CWE-287) due to insufficient server-side verification of payment status. The plugin fails to validate the success of a checkout session with the external payment processor before updating the WooCommerce order status to 'paid'. An unauthenticated remote attacker can exploit this by manipulating the checkout flow to signal a successful transaction, effectively bypassing the payment gateway. This allows for the completion of orders without the transfer of funds. The issue is resolved in version 3.1.1.
Affected products
- Unknown FlxWoo < 3.1.1
Timeline
- 2026-07-13: disclosed
- 2026-07-31: advisory: NVD publication date