The vulnerability exists in the SUMIT Payment Gateway for WooCommerce plugin prior to version 4.0.0. It allows an unauthenticated actor to change a pending order to paid status by replaying a payment identifier that was obtained from an actual transaction. The confirmation process does not verify that the payment belongs to the order or that the amount matches the order total, enabling a fraudster to create false sales records and bypass the merchant’s financial controls. Based on the description, the lack of binding between a payment and its order corresponds to CWE-863: Failure to Bind Request to an Idempotent State.

WordPress sites that use the SUMIT Payment Gateway for WooCommerce plugin with a version lower than 4.0.0 are affected.

The flaw can be triggered through an unauthenticated redirect callback that an attacker can manipulate from any external source. With a CVSS score of 5.3, the vulnerability severity is medium. Based on the description, it is inferred that the attacker does not need any credentials to exploit the issue. Given the EPSS score of less than 1%, the likelihood of exploitation is low, but the lack of authentication combined with the lack of binding between payment details and the order still presents a risk in e-commerce environments. The vulnerability is not yet listed in CISA’s KEV catalog, yet merchants stand to suffer significant financial loss if the driver can be forced to acknowledge a payment that never occurred.