The Order Tip for WooCommerce plugin is vulnerable to unhauthenticated improper input validation that allows attackers to set an excessive or negative tip amount on the checkout form. Because no server‑side check exists on the data-tip attribute, the plugin applies the value directly to the order total, leading to an unauthorized discount that can even bring the order cost to zero or a refund. This flaw directly compromises the financial integrity of transactions on affected sites.

The vulnerability applies to any WordPress site running the railmedia Order Tip for WooCommerce plugin version 1.5.4 or earlier. It affects all installations that expose the tip form during checkout and have not applied a patch that implements proper validation.

The CVSS score of 7.5 denotes high severity, while the EPSS score of < 1 % suggests a low probability of exploitation at present. The issue is not listed in the CISA KEV catalog, indicating no confirmed exploitation. The likely attack path is through a crafted frontend request to the checkout endpoint, where an unauthenticated user can submit a negative tip value and receive an unauthorized discount.