The Oceanpayment CreditCard Gateway plugin allows unauthenticated users to invoke the 'return_payment' and 'notice_payment' functions without any authentication or capability checks. This flaw lets an attacker alter the status of WooCommerce orders, setting them to 'failed', and can also change transaction identifiers. The impact is loss of order integrity and potential financial misreporting, as the attacker can manipulate order history and payment data without needing valid credentials.

oceanpayment:Oceanpayment CreditCard Gateway, all versions up to and including 6.0, deployed on WordPress sites running WooCommerce.

The CVSS score of 5.3 indicates a medium severity, but the EPSS score of less than 1% suggests a low likelihood of widespread exploitation at present. The vulnerability is not listed in CISA’s KEV catalog. The attack vector is inferred as unauthenticated HTTP requests to the plugin’s exposed endpoints, as the functions are callable without authentication checks.