The UniPAY Payment Gateway for WooCommerce WordPress plugin, through version 2.3, fails to properly verify the authenticity of payment notifications. The signature used to confirm a payment is compared against a merchant secret that is empty by default. As a result an attacker can craft a forged payment notification that the plugin accepts as valid, causing the system to mark arbitrary orders as paid. This flaw allows unauthorized individuals to manipulate order status and potentially trigger payment processing or order fulfillment without having paid, leading to financial loss for the merchant and undermining customer trust.

Vendors: Unknown. Product: UniPAY Payment Gateway for WooCommerce WordPress plugin, affected versions up to and including 2.3. The vulnerability is tied to the default empty merchant secret used for IPN notification validation, so any installation that has not set a non‑empty secret is at risk.

The flaw can be exploited without any authentication or additional privileges; the attacker only needs to send a well‑formed IPN request to the plugin’s endpoint. Because the signature check is effectively bypassed, the attack requires minimal effort and no specialized skills. The CVSS score is not provided in the data, and no EPSS score is available, but the absence of exploitation probability data does not reduce the inherent risk. The vulnerability is not listed in CISA’s KEV catalog, yet the potential for financial damage and the ease of exploitation make it a high‑priority issue.