The Eurobank WooCommerce Payment Gateway plugin, version 2.1.1 and earlier, does not verify that the payment‑confirmation request sent from the payment provider is legitimate. Because the plugin ships with a default empty secret, an attacker who can send a forged callback can trick the site into marking any pending order as paid or force an order into a failed state without providing any credentials. This allows an unauthenticated user to modify the financial state of orders and potentially cause fraudulent revenue generation or loss.

This vulnerability affects the WordPress plugin Eurobank WooCommerce Payment Gateway with any release up to and including 2.1.1. The plugin is used by merchants who integrate Eurobank's payment gateway into WooCommerce stores. No other vendors or product versions are listed as affected.

The vulnerability carries a CVSS score of 5.3 and has no EPSS value available, indicating that its exploitation probability is currently unknown. It is not listed in the CISA KEV catalog. The likely attack vector is via a fraudulent HTTP POST request to the callback endpoint that the plugin expects from the payment provider. Because the secret field is empty by default, this call can be crafted without authentication, giving an attacker unrestricted ability to change order status. The impact is limited to the ability to manipulate order payment status, which can lead to financial loss or fraud.