Hello to the team, Arian, it’s been a while 🙂

I investigated an issue where unwanted orders were being created in the Paid Listings flow. In my tests, I was able to reproduce the behavior simply by hovering over the “Buy plan” buttons, without intentionally completing a normal click flow.

With Codex, I traced the behavior and found that the frontend itself does not appear to “click by itself.” However, the theme exposes paid_listings.choose_plan as a real GET URL, and that request is processed server-side with immediate side effects, including order creation.

In the logs, I can clearly see requests with HTTP_SEC_PURPOSE=prefetch hitting paid_listings.choose_plan, followed by pending_payment order creation, even without a normal user click.

So the apparent trigger seems to be browser prefetch / speculative loading, but the theme still executes the request as a real action. In other words, a prefetched GET request can create an order.

From the investigation, the issue seems to come from:

– plan selection URLs being exposed as GET links
– backend handling of choose_plan without a strict HTTP method or prefetch guard
– immediate order creation before checkout is truly finalized or pending payment if it’s not free

Is this a known issue on your side? Also, could this possibly explain other duplicated or unexpected order cases that may have been reported before?

If helpful, I can provide logs showing the prefetch request and the resulting order creation.

Kind regards