PeproDev WooCommerce Receipt Uploader, a WordPress plugin available in versions up to 2.8.0, suffers from an unauthenticated missing‑authorization flaw that grants attackers the ability to overwrite order receipts. The vulnerability, an IDOR (Insecure Direct Object Reference), allows a remote, unauthenticated user to submit a request that alters receipt data, compromising the integrity of financial records. As the plugin processes receipt uploads for WooCommerce orders, tampered receipts could be used to misrepresent payment status or fraudulently adjust order totals.

The affected product is the PeproDev WooCommerce Receipt Uploader WordPress plugin named pepro-bacs-receipt-upload-for-woocommerce. Any WordPress site running this plugin, in any version up to and including 2.8.0, that also has WooCommerce installed, is vulnerable. No operating‑system or other platform specifics are given, but the vulnerability is tied to the WordPress/WooCommerce stack.

The CVSS severity score of 5.3 indicates medium severity, but the absence of authentication checks means any internet‑exposed WordPress site with the plugin can be targeted. The EPSS score is < 1%, suggesting a low probability of exploitation in the wild, and KEV status is not listed, indicating no documented exploit yet. Given the straightforward IDOR mechanism and the plugin’s reliance on WooCommerce data, the likelihood of exploitation remains notable. An attacker can submit a crafted HTTP request to the plugin’s upload endpoint, supply an order identifier, and inject a forged receipt, thereby modifying order records without needing to log in.