The vulnerability exists in the Payment Gateway for Telcell WordPress plugin before version 2.0.5 because it uses an empty string as the secret that signs incoming payment notifications. Consequently the plugin does not verify the authenticity of these notifications. As a result, an attacker can send forged notifications that are accepted as valid, causing WooCommerce orders to be marked as paid without any authentication. Likewise, a notification with an invalid signature is accepted as a failure, allowing the attacker to mark any chosen order as failed. This flaw can lead to financial loss or revenue manipulation for site owners.

The affected software is the Payment Gateway for Telcell WordPress plugin prior to 2.0.5. The plugin is used on WordPress‑based e‑commerce sites that rely on WooCommerce. No further vendor or product details are supplied, and version information is limited to the fact that the issue exists only in releases before 2.0.5.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score is not available, so the probability of exploitation is unclear. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote, with an attacker able to forge HTTP requests to the payment notification endpoint without any authentication. Because the plugin accepts the notification silently, exploitation requires only network connectivity to the site and knowledge of the endpoint URL, making it a realistic threat for exposed e‑commerce installations.