The vulnerability stems from missing capability checks on the ConvesioPay webhook REST endpoint in the PeachPay — Payments & Express Checkout for WooCommerce plugin up to version 1.119.8. Because the endpoint validates no user permissions, an unauthenticated attacker can send a crafted webhook payload and alter the status of any WooCommerce order. This violates the principle of least authority (CWE‑862) and compromises order integrity, potentially enabling fraudulent order cancellations, refunds, or shipping approvals.

The affected product is PeachPay — Payments & Express Checkout for WooCommerce, a WordPress plugin that supports Stripe, PayPal, Square, Authorize.net, and NMI. Versions 1.119.8 and earlier are vulnerable; all later releases should contain a fix.

The CVSS score of 5.3 indicates medium risk, while the EPSS score of less than 1 % suggests a low likelihood of current exploitation. However, the vulnerability is not listed in CISA KEV, meaning no documented active exploitation is known. An attacker can exploit the flaw by sending an unauthenticated HTTP request to the webhook endpoint; no additional credentials or privileged access are required. Because an attacker can modify any order, the impact on confidentiality is low, but integrity and potentially financial loss are significant.