The Direct Payments for WooCommerce plugin, before version 2.5.3, fails to verify that the requester controls the targeted WooCommerce order when processing several AJAX actions. This omission allows an unauthenticated actor to change order status, overwrite payment metadata, forge a "payment sent" flag, alter the payment‑method label, and attach fraudulent payment‑proof files. The flaw is a classic example of improper authorization (CWE‑284).

All WordPress sites using the Direct Payments for WooCommerce plugin older than version 2.5.3 are potentially affected, regardless of the administrator’s ability to manage orders. The vulnerability does not rely on a particular WordPress theme or WooCommerce version, only on the presence of the plugin’s vulnerable code.

The flaw requires no authentication and can be triggered via public AJAX endpoints over HTTP or HTTPS, making it trivial for an attacker who can reach the site. The CVSS score of 5.3 and EPSS score of less than 1% indicate a moderate risk level, while the vulnerability is not listed in CISA's KEV catalog. Nonetheless, the impact on order integrity and financial records is significant, warranting urgent attention.