The vulnerability resides in the Campay Woocommerce Payment Gateway plugin for WordPress up to version 1.2.2. It originates from insufficient validation that a transaction has actually passed through the payment gateway. Consequently, an attacker who does not need to authenticate can submit a crafted request to mark an order as completed, thereby bypassing the legitimate payment process and causing a loss of income for the merchant. This issue is identified as CWE‑639, an authorization bypass that occurs through user‑controlled data.

WordPress sites running the Campay Woocommerce Payment Gateway plugin, specifically those using version 1.2.2 or any earlier release.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score of less than 1% suggests a low probability of widespread exploitation. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that the attacker can exploit this weakness by sending an unauthenticated HTTP request to the plugin’s payment completion endpoint, thereby bypassing payment validation and marking orders as complete.