The Online Payments with iK Pay Gateway WordPress plugin before version 3.0.4 does not properly verify the authenticity of its payment gateway callback on a default installation. As a result, unauthenticated attackers can forge successful payment notifications, marking arbitrary orders as paid without any payment being made, or they can cause unprocessed orders to be marked as failed. This flaw allows attackers to manipulate order status and potentially facilitate financial fraud or unauthorized revenue generation.

The vulnerability affects the Online Payments with iK Pay Gateway WordPress plugin before 3.0.4. The exact vendor is listed as Unknown:Online Payments with iK Pay Gateway, indicating a third‑party plugin used in WordPress environments. No specific system configurations or additional dependencies are disclosed in the input, so any site running the plugin at a pre‑3.0.4 version is susceptible.

The flaw is unauthenticated, meaning any actor who can reach the callback endpoint can abuse it, which raises the likelihood of exploitation. The EPSS score is not provided, and the vulnerability is not listed in CISA’s KEV catalog, but the potential impact on financial transactions is high. Attackers would forge a callback using the same format as the payment gateway, and the lack of authenticity checks allows the plugin to accept the forged notification as legitimate. Since the vulnerability is present in a default installation, it is likely that no special configuration is required for exploitation.