The CryptoCloud WordPress plugin releases from 3.0.0 through 3.0.1 omit integrity verification of payment notifications sent by the gateway when the webhook secret defaults to an empty string. An unauthenticated attacker can exploit this shortcut to submit fabricated webhook payloads, marking any order as paid or failed without completing a real transaction. This flaw allows direct manipulation of order status and can result in financial loss or service disruption for the hosting store.

CryptoCloud WordPress plugin versions 3.0.0 through 3.0.1 are affected. The vulnerable code resides in the callback handling of the payment gateway module. Only these specific major/minor releases are impacted; newer releases have presumably fixed the issue.

With a CVSS score of 5.3, the vulnerability is categorized as moderate. No EPSS information is available, and the flaw is not listed in the CISA KEV catalog, suggesting limited public exploitation at the time of analysis. The attack is likely to be carried out by submitting forged webhook requests to the gateway endpoint, a process that requires no prior authentication due to the skipped integrity check. Successful exploitation would allow unauthorized alteration of order payment states for any user.