Technical impact
The Payment Gateway via Valitor for WooCommerce plugin allows an attacker to craft a payment callback that the system accepts as authentic because it relies on a hard‑coded verification secret shipped with every installation. By forging a callback containing a valid but default secret, an unauthenticated attacker can cause arbitrary orders to be marked as paid, enabling financial fraud and eroding the integrity of the store’s revenue tracking. This flaw represents an authentication bypass allowing the attacker to alter order status without possessing legitimate payment confirmation.
Affected Systems
Any WordPress site that has installed the Payment Gateway via Valitor for WooCommerce plugin at a version prior to 1.9.41 and has not changed the default verification code is affected. The plugin itself is offered by an undisclosed vendor and is distributed as part of the WordPress ecosystem through the plugin repository.
Risk and Exploitability
Exploit knowledge is sufficient for a remote attacker to execute the attack by sending a malicious callback to the plugin’s payment confirmation endpoint. While the exploit simply requires HTTP access to that endpoint, the attacker can target any system with the vulnerable plugin regardless of user authentication. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, yet the potential financial damage and ease of exploitation suggest a high risk. The lack of official mitigation details from the vendor underscores the urgency of patching or manually hardening the verification process.
