The Gateway for Vantiv on WC plugin, available through version 1.0.1, fails to verify the authenticity of incoming payment notifications sent to its hosted-payment return handler. This omission allows attackers to forge callbacks that convince the system that an order has been paid. As a result, attackers can create or manipulate orders, mark them as paid, and potentially claim purchased items without actual payment. The impact is primarily financial fraud and loss of revenue.

The vulnerability affects the Gateway for Vantiv on WC WordPress plugin versions up to and including 1.0.1. The plugin is distributed by an unnamed vendor and commonly used in WordPress-based storefronts that process payments through the Vantiv payment gateway.

Because the plugin does not authenticate payment callbacks, remote attackers can send forged notifications from anywhere on the internet to the hosted-payment return handler. The likelihood of exploitation is high as the flaw does not require prior access, and no authentication step is performed. No EPSS score is available, the vulnerability is not listed in CISA KEV, and the CVSS score is 5.3, indicating a medium severity, but the potential for financial loss remains significant.