The FlxWoo plugin vulnerability (CVE-2026-14830) is a payment verification bypass with CVSS 7.5 that deserves more attention than its low EPSS score (0.00208) suggests. The flaw allowed attackers to complete orders without actual payment by exploiting a shortcut in the plugin's checkout flow — the code marked orders paid based on session existence rather than processor verification. Version 3.1.1 patches this, but the EPSS score is misleading: it reflects current scanner signatures, not the real exposure in the WooCommerce plugin ecosystem where sites install and run unpatched for months or years.
Here's what matters for defenders. First, check whether you run FlxWoo and which version — if you're below 3.1.1, patch immediately. Second, understand the blast radius: this isn't just a checkout bug, it's an operational one. Exploitation looks like legitimate orders, triggering fulfillment, shipping, and inventory depletion before you notice. Monitor for orders with anomalous patterns — zero-value payments, unusual quantities, or shipping addresses that don't match fraud profiles. Third, recognize the architectural pattern: WooCommerce plugins repeatedly surface this exact payment-bypass variant because the framework makes verification the optional path rather than the default. Even after patching, audit other WooCommerce payment plugins for the same shortcut — the insecure pattern (trusting session state over processor webhooks) is a class of vulnerability, not an isolated flaw.
The low EPSS score shouldn't deprioritize remediation. It reflects that automated scanners haven't built signatures for WooCommerce-specific bypass patterns yet — not that the vulnerability isn't exploitable. Attackers target plugin ecosystems with long remediation tails. They know thousands of merchants won't see this CVE in their dashboards. Patch anyway, and treat the EPSS score as a detection gap, not an absence of risk.