Technical impact
Based on the description, the CCAvenue Payment Gateway for WooCommerce plugin does not validate that a payment‑confirmation request genuinely originates from the payment provider. The verification key is derived from an empty value when the plugin is installed with default settings, enabling any requester to forge a confirmation and mark a WooCommerce order as paid without receiving funds. This weakness is an instance of improper access control (CWE-284). The resulting effect is that attackers can signal payment receipt for any order, potentially causing financial loss, inventory mismanagement, and customer trust erosion.
Affected Systems
The vulnerability affects the CCAvenue Payment Gateway for WooCommerce WordPress plugin, versions up to and including 3.1. It is deployed on WordPress sites that use WooCommerce and exposes a public webhook endpoint that processes payment-confirmation messages. The flaw resides in the order-processing logic at this endpoint, which should be authenticated but is not.
Risk and Exploitability
The EPSS score of 0.00137 indicates a very low but nonzero exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, the flaw permits a straightforward unauthenticated POST request to the plugin’s confirmation URL, allowing an attacker to complete any WooCommerce order. The CVSS score of 5.3 indicates medium severity, reflecting the impact of erroneously marking orders as paid without revenue. Even with a moderate CVSS rating, the lack of authentication makes the vulnerability high risk for any site using the affected plugin version.
