CVE-2026-121993
wePOS before 2.0.3 Missing Authorization via payment/process Endpoint
CVSS Score
4.3
EPSS Score
0.0%
EPSS Percentile
0th
wePOS (Point Of Sale for WooCommerce) before 2.0.3 contains a missing authorization vulnerability in the wepos/v1/payment/process REST route that allows authenticated vendor-level users to mark arbitrary orders as paid and completed by supplying another order's ID. Attackers with only the publish_shop_orders capability (such as Dokan vendor staff) can invoke the payment processing endpoint with an order ID they do not own to trigger the order completion lifecycle, including stock reduction and granting of paid-order access, without making any real payment.
| CWE | CWE-862 |
| Vendor | wedevs |
| Product | wepos – point of sale (pos) for woocommerce & dokan |
| Published | Nov 4, 2026 |
Stay Ahead of the Next One
Get instant alerts for wedevs wepos – point of sale (pos) for woocommerce & dokan
Be the first to know when new medium vulnerabilities affecting wedevs wepos – point of sale (pos) for woocommerce & dokan are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
None
Affected Versions
wedevs / wePOS – Point Of Sale (POS) for WooCommerce & Dokan
1.2.6 < 2.0.3
References
wordpress.org: https://wordpress.org/plugins/wepos/#developers plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/log/wepos/ github.com: https://github.com/getdokan/wepos/pull/232 github.com: https://github.com/getdokan/wepos/releases/tag/v2.0.3 vulncheck.com: https://www.vulncheck.com/advisories/wepos-before-missing-authorization-via-payment-process-endpoint
Credits
buiih