The Vietnamese WordPress plugin Thanh Toán Quét Mã QR Code Tự Động, versions up to 2.0.1, fails to authenticate bank‑transfer payment notifications. An attacker can craft a notification without credentials, causing WooCommerce to mark any order as paid. This leads to fraudulent revenue recognition, inventory misallocation, and potential legal exposure if fraudulent orders are processed.

The vulnerability affects WordPress sites running the Thanh Toán Quét Mã QR Code Tự Động plugin in any version 2.0.1 or earlier. Sites that have WooCommerce installed and allow bank‑transfer payments are directly impacted.

Because the notification endpoint lacks authentication checks, an unauthenticated attacker can trigger the vulnerability by sending a crafted request to the WooCommerce payment notification URL. No EPSS information is available, and the issue is not listed in CISA KEV, so the precise exploitation likelihood is uncertain; however, the lack of verification and the critical nature of payment status changes mean the risk is significant for exposed WooCommerce installations.