Medium
Livees Checkout 6.8 - 7.0.2 - Unauthenticated Order Status Change, Order Note Injection & Order Key Disclosure
The Livees Checkout WordPress plugin through 7.0.2 does not perform any capability, nonce or order-key check before acting on request parameters on the order confirmation page, allowing unauthenticated users to change the status of arbitrary orders, store arbitrary data and notes on them, and recover their order keys.
Announced Source revision 1
Original source ↗CVE-2026-86851
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-86851
Livees Checkout
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"vendor": "Unknown",
"product": "Livees Checkout",
"versions": [
{
"status": "affected",
"version": "6.8",
"versionType": "semver",
"lessThanOrEqual": "7.0.2"
}
],
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unknown"
}
]- Related CVEs
- CVE-2026-86851
Source reference:
/cveMetadata/cveId
Publisher severity
medium
Source reference: /containers/cna/metrics
- Event
- #16283 · Revision 1
- Added to Heist Feed
- Publisher date