Technical impact
The OPay Payment Gateway for WooCommerce plugin does not verify that payment notifications are signed by the payment provider because the default secret key is an empty string. An attacker can therefore forge a valid notification and cause a merchant’s site to mark any order as paid, cancelled or failed. This allows financial fraud, inventory mismanagement, and a loss of customer trust. The flaw permits an attacker to execute the attack without any authentication or privileged access to the WordPress admin interface, making it a straightforward remote exploitation.
Affected Systems
The vulnerability is present in all releases of the OPay Payment Gateway for WooCommerce up to and including version 2.5.5. Any WordPress site that has this plugin installed and has not applied a later update is affected.
Risk and Exploitability
Based on the description, it is inferred that the attack vector is remote and unauthenticated. The secret key is empty by default, so an attacker only needs to send a crafted HTTP request to the payment notification endpoint. No exploitation prerequisites beyond internet connectivity are required. The vulnerability is not listed in CISA’s KEV catalog and has an EPSS score of 0.00137. With a CVSS score of 5.3, the flaw is considered moderate severity; however, the potential for direct financial loss and order processing disruption remains significant.
