The WordPress "Conekta Payment Gateway" plugin versions prior to 6.2.2 fail to verify the authenticity of payment gateway webhook notifications, do not bind the confirmed payment to a specific order, and do not check the transaction amount. As a result, attackers who can send a forged webhook request can mark any order as paid without a real transaction, leading to direct financial loss and undermining order integrity.

All WordPress sites that have installed the "Conekta Payment Gateway" plugin at a version earlier than 6.2.2 are vulnerable. The flaw exists in the plugin’s webhook handling logic and affects every instance of the plugin on any website that has not applied the update.

The CVSS score of 5.3 indicates a moderate impact. The CVE’s EPSS score is < 1% and it is not listed in the CISA KEV catalog, suggesting a low probability of exploitation. Because the flaw allows an attacker to send a crafted HTTP POST to the plugin’s webhook URL without authentication or special credentials, the vulnerability remains technically exploitable, but the low EPSS indicates that real‑world exploitation is expected to be infrequent. The lack of authentication and input validation in the webhook endpoint therefore poses a moderate security concern rather than a high one for affected installations.