The Wizit Gateway for WooCommerce plugin contains a flaw in the handle_checkout_redirecturl_response function that fails to enforce authentication and authorization. An attacker can send a crafted HTTP request with a valid order identifier to cancel any WooCommerce order without needing to log in. This capability undermines the integrity of the e‑commerce process, allowing fraud or revenue loss by removing orders before payment is processed or altering order status to reflect cancellations.

All installations of the Wizit Gateway for WooCommerce plugin up to and including version 1.2.9 are affected. The issue exists in every version of the plugin released prior to 1.2.10.

The CVSS score of 5.3 indicates moderate severity, while the EPSS score of less than 1% raises doubts about the likelihood of exploitation at this time. The vulnerability is listed as not in the CISA KEV catalog, reflecting its low current exploitation probability. Based on the description, the attack vector is inferred to be via a straightforward HTTP request to the checkout redirect URL endpoint, with the prerequisite of knowing an existing order ID. Once the attacker submits the crafted request, the order is canceled immediately, potentially causing financial and operational damage to the merchant.