The PAYGENT for WooCommerce plug‑in for WordPress contains a missing authorization flaw that allows an unauthenticated attacker to trigger the paygent_check_webhook endpoint. The callback logic itself performs no authentication, and the permission callback always returns true, so crafted POST requests to the exposed /wp-json/paygent/v1/check/ URL can be used to spoof payment notifications. By doing so, an attacker can alter the status of existing orders, promote pending orders to paid, or downgrade confirmed payments, thereby enabling financial fraud or denial of service to legitimate customers.

This weakness is present in the shoheitanaka “PAYGENT for WooCommerce” WordPress plug‑in, affecting every release up to and including version 2.4.6. Site administrators running any of these versions are susceptible because the flaw is in the core endpoint logic and is not limited by other configuration settings. Versions newer than 2.4.6 are exempt, but no version list is explicitly supplied in the original data.

The CVSS score of 5.3 indicates moderate severity, while the EPSS score of less than 1 % suggests a low current probability of exploitation in the wild. The flaw is not listed in the CISA KEV catalog, but the absence of authentication on a public REST endpoint means that an attacker can exercise the vulnerability from any network with access to the site. The impact is primarily on data integrity and financial loss rather than code execution, and mitigation hinges on updating the plug‑in or blocking the endpoint until a patch becomes available.