The Xendit Payment WordPress plugin exposes an unauthenticated WooCommerce API callback that accepts payment notifications without verifying the origin. An attacker can send a crafted POST request with a JSON payload specifying an order identifier and a status of 'PAID' or 'SETTLED'. If the attacker can determine sequential numeric order IDs, they can mark any order as paid without any actual transaction, allowing fraudulent order fulfillment and inventory loss.

The vulnerability affects the Xendit Payment plugin from the vendor identified as tpixendit (Xendit Payment). All plugin versions up to and including 6.0.2 are impacted. The issue surfaces when the plugin is installed on a WordPress site running WooCommerce and the public callback endpoint is reachable.

The CVSS score of 5.3 indicates a moderate severity impact on confidentiality, integrity, and availability of financial data. The EPSS score of less than 1% suggests low exploitation probability, and the vulnerability is not currently listed in CISA KEV. Nevertheless, because the attack requires no authentication and the endpoint is publicly reachable, a remote attacker who can enumerate order IDs can exploit it, leading to financial loss for the merchant. The attack vector is likely remote over HTTP(S) to the standard WooCommerce endpoint, with the prerequisite of knowing or guessing sequential order IDs.