The BDM Digital Payment Gateway WordPress plugin, from versions 1.2.7 to 1.3.12, fails to validate credentials on its public payment-status update route. When the credentials field in a request is left empty, the plugin accepts the request as authenticated and updates any WooCommerce order status to paid. This flaw enables an attacker to forge payment confirmations for arbitrary orders without actually performing any payment, leading to revenue loss and potential inventory or fulfillment problems.

The vulnerability affects the BDM Digital Payment Gateway plugin for WordPress in versions 1.2.7 to 1.3.12. No other vendors or products are documented as impacted.

The CVSS score of 5.3 indicates a medium severity. The EPSS score is not available, and the flaw is not listed in CISA's KEV catalog. Attackers can exploit the flaw by sending unauthenticated HTTP requests to the payment-status endpoint, a likely attack vector inferred from the lack of authentication on the route. The impact is significant for merchants relying on accurate payment status, but the need to target specific order IDs and the absence of remote code execution suggest the likelihood of widespread exploitation may be moderate. Prompt mitigation is recommended.