Technical impact
The Eurobank WooCommerce Payment Gateway plugin, version 2.1.1 and earlier, suffers from a broken authentication weakness, improper verification of the payment‑confirmation request source, and the use of an empty secret (CWE-345). Because the plugin ships with a default empty secret, an attacker who can send a forged callback can trick the site into marking any pending order as paid or force an order into a failed state without authentication. This allows an unauthenticated user to modify the financial state of orders and potentially cause fraudulent revenue generation or loss.
Affected Systems
This vulnerability affects the WordPress plugin Eurobank WooCommerce Payment Gateway with any release up to and including 2.1.1. The plugin is used by merchants who integrate Eurobank's payment gateway into WooCommerce stores. No other vendors or product versions are listed as affected.
Risk and Exploitability
The vulnerability carries a CVSS score of 5.3 and has no EPSS value available, indicating that its exploitation probability is currently unknown. It is not listed in the CISA KEV catalog. The likely attack vector is via a fraudulent HTTP POST request to the callback endpoint that the plugin expects from the payment provider. Because the secret field is empty by default, this call can be crafted without authentication, giving an attacker unrestricted ability to change order status. The impact is limited to the ability to manipulate order payment status, which can lead to financial loss or fraud.
