The PayU CommercePro WordPress plugin versions prior to 3.9.0 does not verify the payment‑gateway signature before applying order modifications, allowing unauthenticated attackers to tamper with the totals, shipping and metadata of arbitrary WooCommerce orders. This flaw enables an attacker to alter order data without authorization, potentially resulting in financial loss or data integrity issues for merchants. The description does not explicitly state the exact impact beyond the risk of order manipulation, so the inference focuses on order integrity compromise.

PayU CommercePro Plugin, all releases prior to version 3.9.0.

The CVSS score of 5.3 indicates a moderate risk. An EPSS score of less than 1% suggests that automated exploitation is unlikely. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is an unauthenticated HTTP request to a plugin endpoint that processes order updates; because the signature check is missing, an attacker can craft a request to modify any WooCommerce order without needing credentials.