The Super Payments WordPress plugin prior to version 1.43.1 fails to verify the authenticity of incoming payment webhook notifications because the signing key used for validation is empty by default. This defect allows an attacker who can send a malicious webhook to forge a signature that the plugin accepts as valid, thereby marking arbitrary WooCommerce orders as paid without actually receiving payment. This vulnerability is a variation of the weakness CWE-347, indicating an improper verification of hash signatures, and the consequence is a loss of revenue and potential fraud exposure for merchants using the plugin.

The vulnerability affects installations of the Super Payments plugin for WordPress running any version before 1.43.1. No specific WordPress core or WooCommerce version requirement is stated, so the issue applies to all deployments of the plugin within that version range.

The CVSS score of 5.3 indicates moderate severity. Because the EPSS score is not available and the vulnerability is not listed in CISA KEV, there is no current evidence of widespread exploitation. An attacker can initiate the exploit from anywhere on the internet by sending a crafted HTTP request to the plugin’s webhook endpoint. The prerequisite is the ability to reach the site’s webhook URL, but no authentication is required, making the attack highly feasible in environments lacking access controls on the webhook endpoint.