Missing Authorization in wePOS for WooCommerce Allows Order Manipulation

Executive Summary

This vulnerability is a missing authorization issue in the wePOS plugin before version 2.0.3. It allows authenticated vendor-level users, such as Dokan vendor staff, to mark any order as paid and completed by supplying another order's ID. The flaw exists in the wepos/v1/payment/process REST route, which only checked for the publish_shop_orders capability without verifying ownership of the order.

Useful 0 Not Useful 0

Detection Guidance

Check if your wePOS plugin version is below 2.0.3 by inspecting the plugin files or WordPress admin panel. Look for unauthorized order completions in WooCommerce logs or database entries where orders were marked paid without transactions. Review REST API logs for POST requests to /wp-json/wepos/v1/payment/process with mismatched order IDs.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows unauthorized users to mark orders as paid without processing real payments. This can lead to financial losses, incorrect inventory reduction, and unauthorized access to paid-order features. Vendors could manipulate orders belonging to other vendors or the main store, disrupting business operations and trust.

Useful 0 Not Useful 0

Mitigation Strategies

Update wePOS to version 2.0.3 or later immediately. Verify the update by checking the plugin version in WordPress. Review all recent orders marked as paid without transactions and reverse unauthorized changes. Ensure Dokan vendor permissions are correctly configured to restrict access to only their own orders.

Useful 0 Not Useful 0