The CamPay Shortcode Payment Gateway plugin for WordPress fails to verify the authenticity of mobile money payment confirmations and relies solely on client‑supplied parameters to determine payment status, a weakness rooted in CWE-862. Because of this, an unauthenticated attacker can manipulate the outcome of payment records, marking them as paid, deleting legitimate records, and inserting plugin metadata into arbitrary posts. The result is financial loss, loss of data integrity, and potential disruption of legitimate transactions.

Any WordPress site that has installed CamPay Shortcode Payment Gateway plugin version lower than 1.7 is affected. The vendor is listed as CamPay Shortcode Payment Gateway, but the plugin is distributed under an unknown vendor umbrella.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score is reported as less than 1 % while the vulnerability is not listed in the CISA KEV catalog, indicating that active exploitation may be rare at present. However, because the flaw allows unauthenticated manipulation of payment records and content injection, its potential impact remains high. Based on the description, it is inferred that attackers can target the plugin by submitting forged payment confirmation data via normal HTTP requests, without needing any authentication or privileged access.