PeproDev WooCommerce Receipt Uploader, a WordPress plugin available in versions up to 2.8.0, suffers from an unauthenticated missing‑authorization flaw that grants attackers the ability to overwrite order receipts. The vulnerability, an IDOR (Insecure Direct Object Reference), enables a remote, unauthenticated user to submit a request that alters receipt data, compromising the integrity of financial records. As the plugin processes receipt uploads for WooCommerce orders, tampered receipts could be used to misrepresent payment status or fraudulently adjust order totals.

The affected product is the PeproDev WooCommerce Receipt Uploader WordPress plugin named pepro-bacs-receipt-upload-for-woocommerce. Any WordPress site running this plugin, in any version up to and including 2.8.0, that also has WooCommerce installed, is vulnerable. No operating‑system or other platform specifics are given, but the vulnerability is tied to the WordPress/WooCommerce stack.

The CVSS severity score is not provided, but the absence of authentication checks means any internet‑exposed WordPress site with the plugin can be targeted. EPSS is not available and the vulnerability has no presence in CISA's Known Exploited Vulnerabilities catalogue, indicating no documented exploit yet. However, given the straightforward IDOR mechanism and the plugin’s reliance on WooCommerce data, the likelihood of exploitation in real‑world scenarios remains high. An attacker can submit a crafted HTTP request to the plugin’s upload endpoint, supply an order identifier, and inject a forged receipt, thereby modifying order records without needing to log in.