The Payaza plugin for WordPress contains a missing capability check on the wp_ajax_nopriv_update_order_status AJAX endpoint. This flaw allows an attacker without any authentication to invoke the endpoint and arbitrarily change the status of orders. Such unauthorized modifications can lead to fraudulent order handling, potential financial loss, and undermining the integrity of the store’s transaction records. The weakness corresponds to CWE‑862, a missing authorization failure.

The vulnerability affects the Payaza plugin developed by bigmaster, released under the bigmaster:Payaza vendor. All versions of the plugin up to and including 0.3.8 are impacted. Users running Payaza on a WordPress site with any of these versions can be targeted.

The CVSS score of 5.3 indicates moderate severity, while the EPSS score of less than 1% suggests that the likelihood of exploitation is currently very low. The vulnerability is not listed in the CISA KEV catalog. Attackers can trigger the flaw by sending an HTTP request to the wp_ajax_nopriv_update_order_status endpoint without authentication, typically by crafting a POST request with parameters that set the desired order status. The flaw does not require any special privileges or initial compromise, making it a straightforward unauthenticated data modification vector.