Vulnerability · Published Nov 4, 2026 · Assigned by VulnCheck
CVE-2026-121993wePOS before 2.0.3 Missing Authorization via payment/process Endpoint
Medium 4.3
In plain English
A medium-severity missing authorization in wePOS – Point Of Sale (POS) for WooCommerce & Dokan from wedevs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities).
Official description
wePOS (Point Of Sale for WooCommerce) before 2.0.3 contains a missing authorization vulnerability in the wepos/v1/payment/process REST route that allows authenticated vendor-level users to mark arbitrary orders as paid and completed by supplying another order's ID. Attackers with only the publish_shop_orders capability (such as Dokan vendor staff) can invoke the payment processing endpoint with an order ID they do not own to trigger the order completion lifecycle, including stock reduction and granting of paid-order access, without making any real payment.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| wedevs | wePOS – Point Of Sale (POS) for WooCommerce & Dokan | 1.2.6 – before 2.0.3 |
Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
References
- Vendor Patch patch, release-notes
- https://plugins.trac.wordpress.org/log/wepos/
- https://github.com/getdokan/wepos/pull/232 issue-tracking
- https://github.com/getdokan/wepos/releases/tag/v2.0.3 release-notes
- VulnCheck Advisory: wePOS before 2.0.3 Missing Authorization via payment/process Endpoint third-party-advisory