The iPaymu Payment Gateway for WooCommerce plugin contains a missing authentication flaw in its 'check_ipaymu_response' function. An attacker can send crafted POST requests to the webhook endpoint without authenticating, causing the plugin to accept the request and prematurely mark a WooCommerce order as paid. Additionally, a simple GET request can enumerate order IDs and expose order keys, revealing personally identifiable information such as customer names, addresses, and purchased products. The weakness corresponds to CWE-862 (Missing Authorization).

This vulnerability affects the iPaymu Payment Gateway for WooCommerce WordPress plugin for all releases up to and including version 2.0.2. Any site using this plugin version is potentially compromised.

The CVSS score of 8.2 denotes a high severity vulnerability; the EPSS score is below 1 %, indicating a low likelihood of exploitation in the wild, and the issue is not tracked in the CISA KEV catalog. It is likely that the attack can be conducted over HTTP to the exposed webhook endpoint due to the missing authentication checks, but this direction is inferred from the plugin design and not explicitly stated in the advisory. An unauthenticated attacker only needs to send crafted POST requests to the webhook URL and craft enumeration GET queries, making the attack vector web-based and straightforward.