Technical impact
The vulnerability exists in the Mintpay for WooCommerce plugin version 2.2.3 and earlier. The plugin accepts payment callbacks without verifying their origin or integrity. An attacker can craft a request and cause the system to mark an order as paid, cancel an order, or retrieve the order details, including customer contact information. This flaw is a lack of input authentication and safeguards, allowing unauthorized manipulation of orders and exposure of personally identifiable data. The weakness falls under access control and input validation errors.
Affected Systems
WordPress plugin Mintpay for WooCommerce, version 2.2.3 and earlier. The plugin is used in WooCommerce-based e‑commerce sites to process payments.
Risk and Exploitability
The flaw can be exploited remotely by sending a forged payment callback that bypasses authentication checks. No prior credentials or site access are required. The CVSS score of 6.5 indicates moderate severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. The potential impact spans order integrity and confidentiality of customer data, with a non‑negligible risk for e‑commerce operators who rely on the plugin.
