Thank you for the details, we could reproduce it.
The cart is protected: when a product in a cart is unpublished, or its stock drops below the quantity in the cart, the checkout removes it before the order can be placed. The gap is the "Pay now" button customers see in their account for orders still waiting for their payment (for example after a failed or cancelled payment). That button did not check the products again, so an unpaid order could still be paid after its product was unpublished. If you have the setting "Update the product stock on confirmed status" turned on, it could also be paid after the product sold out, because such an order does not hold any stock until it is confirmed.
We have changed HikaShop so that "Pay now" refuses an order whose product is unpublished, deleted or, with that stock setting, out of stock. The customer then gets the same message as in the cart. This also covers the options chosen with a product and the products included in a bundle.
You can download the install package of HikaShop on our website and install it on yours in order to get the patch.
If you have a case where the product was bought straight from the cart and not from "Pay now", please tell us which payment method was used, whether the product was a bundle, and whether you use any other checkout or cache extension, so that we can look into it.
