Visma Pay for WooCommerce before 1.2.2 does not authenticate gateway return requests, using an empty merchant secret when credentials are missing. This flaw lets an unauthenticated attacker trigger the payment confirmation endpoint, marking arbitrary orders as paid and enabling the attacker to retrieve the name, email address and postal address of any customer who placed an order. The impact is unauthorized financial processing and exposure of personally identifiable information, compromising order integrity and customer confidentiality.

The vulnerability affects the Visma Pay for WooCommerce WordPress plugin on any store running a version earlier than 1.2.2. The plugin is available through the WordPress plugin repository and is used in WordPress sites that have not configured a merchant secret.

The CVSS score of 6.5 indicates a moderate severity. EPSS data is not available, so the likelihood of exploitation cannot be quantified from the current data, but the lack of authentication on a publicly exposed payment endpoint makes exploitation straightforward for attackers with no credentials. The vulnerability is not listed in the CISA KEV catalog, however the attack vector is external and unauthenticated, and the impact includes potential financial fraud and data leakage.