The vulnerability arises because Mintpay for WooCommerce processes payment callbacks without verifying their source or integrity. An attacker who can fabricate such callbacks can mark any order as paid, cancel any order, and read order details, including customer contact information. The flaw constitutes a lack of input authentication and authorization, enabling remote denial of service within the ordering subsystem and the exfiltration of customer data. The impact spans confidentiality, integrity, and availability of the e‑commerce system, potentially exposing personally identifiable information and disrupting business operations.

WordPress plugin Mintpay for WooCommerce of version 2.2.3 and earlier is affected. The plugin is used to handle payment processing for WooCommerce shops; no further version granularity is available in the public data.

The flaw is a remote exploitation scenario that requires the attacker to send a forged callback to the plugin. Because the plugin does not authenticate the callback, no prior access or credentials are needed. The CVSS score is high due to this lack of authentication, but no EPSS score is provided. The vulnerability is not listed in the CISA KEV catalog, suggesting it is currently unexploited or not widely tracked, yet the potential for mass disclosure or business compromise remains significant.