The vulnerability in the Casso Flow WordPress plugin allows an attacker to forge bank‑transfer payment notifications because the verification token is empty by default. An unauthenticated attacker can send a crafted notification to the shop, causing any pending WooCommerce order to be marked as paid regardless of the actual payment method. This can lead to fraudulent transactions and financial loss, demonstrating a failure in authentication mechanisms (CWE‑287).

The issue affects installations of the Casso Flow WordPress plugin that are before version 4.2.0 and that use WooCommerce for order management. Any site using this plugin and not up‑to‑date with the fix is susceptible.

Although no EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, the lack of authentication provides a direct method for an attacker to alter order status without credentials. The potential impact is high; however, exploitation probability cannot be quantified from the current data. The vulnerability is accessible to anyone who can send HTTP requests to the notification endpoint and does not require any additional privileges.