CVE-2026-86851

Status: DeferredMedium (6.5)—

The Livees Checkout WordPress plugin through 7.0.2 does not perform any capability, nonce or order-key check before acting on request parameters on the order confirmation page, allowing unauthenticated users to change the status of arbitrary orders, store arbitrary data and notes on them, and recover their order keys.

CVSS

Version: 3.1
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Base score: 6.5

Exploitation probability (EPSS)

Probability of exploitation in the next 30 days: 0.16%
Percentile among all scored CVEs: 5
Score date: 10/17/2026

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

🎯 ATT&CK techniques

How this vulnerability is exploited and what the attacker gains, in MITRE ATT&CK terms.

ExploitationT1190 Exploit Public-Facing Applicationinitial access95 %
Primary impactT1565.001 Stored Data Manipulationimpact90 %
Secondary impactT1005 Data from Local Systemcollection85 %
Secondary impactT1212 Exploitation for Credential Accesscredential access80 %

AV:N/PR:N permite explotación remota sin autenticación (T1190). Manipulación de estado de pedidos y datos (T1565.001), acceso a claves de pedidos (T1212) y lectura de información de órdenes (T1005) sin validación de seguridad (capability/nonce).

Inferred by our analysis agent from the official description, CVSS vector and CWE, and checked by a supervisor. May contain errors.

🛡️ ATT&CK mitigations that cover these techniques

Application Isolation and Sandboxing Exploit Protection Update Software Application Developer Guidance Vulnerability Scanning Threat Intelligence Program

Affected technologies (1)

⚠ AI-inferred from the description — NVD hasn't analyzed this CVE yet, these aren't verified CPEs.

Livees — Livees Checkout^AI

CWEs

CWE-862

References

https://wpscan.com/vulnerability/c9730831-54a3-4307-94c9-e994337a943c/

Raw JSON (NVD)

Show

{
  "id": "CVE-2026-86851",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-86851",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-10-09T14:49:35.606886Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "contact@wpscan.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.5,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "contact@wpscan.com",
      "affectedData": [
        {
          "vendor": "Unknown",
          "product": "Livees Checkout",
          "versions": [
            {
              "status": "affected",
              "version": "6.8",
              "versionType": "semver",
              "lessThanOrEqual": "7.0.2"
            }
          ],
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2026-10-09T12:17:12.737",
  "references": [
    {
      "url": "https://wpscan.com/vulnerability/c9730831-54a3-4307-94c9-e994337a943c/",
      "source": "contact@wpscan.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Livees Checkout WordPress plugin through 7.0.2 does not perform any capability, nonce or order-key check before acting on request parameters on the order confirmation page, allowing unauthenticated users to change the status of arbitrary orders, store arbitrary data and notes on them, and recover their order keys."
    }
  ],
  "lastModified": "2026-10-09T15:17:18.657",
  "sourceIdentifier": "contact@wpscan.com"
}