An unauthenticated attacker can forge payment status updates through the Worldpayxml connector because the component that validates webhook requests always returns true and no mutual TLS is enforced. By sending a crafted unsigned XML payload containing an order identifier, the merchant ID, and setting the lastEvent field to SETTLED, an attacker can cause the system to mark an unpaid payment as charged or trigger refund, dispute, and payout events. This enables financial fraud and may lead to unauthorized fund movements or disputed charges.

The Vulnerability affects the Hyperswitch payment platform developed by Juspay, specifically all releases prior to version 1.128.0 that include the Worldpayxml connector module. The issue remains until the code base is updated past that checkpoint.

With a CVSS score of 8.2 the vulnerability is classified as High severity. The lack of an authentication check means the attacker can exploit the flaw remotely over the network by POSTing the XML to the webhook endpoint, provided they know the merchant_id and orderCode. The EPSS score is not available and the issue has not been listed in the CISA KEV catalog, but the potential for large financial impact and the ease of exploitation make it a significant risk for affected deployments.