The WordPress "Conekta Payment Gateway" plugin versions prior to 6.2.2 fail to verify the authenticity of payment gateway webhook notifications, do not bind the confirmed payment to the specific order, and do not check the amount. As a result, attackers who can send a forged webhook request can mark any order as paid without a real transaction. This flaw allows unauthenticated users to trigger payment completion for arbitrary orders, potentially causing direct financial loss and undermining order integrity.

All WordPress sites running the "Conekta Payment Gateway" plugin at a version earlier than 6.2.2 are vulnerable. The flaw exists in the plugin’s webhook handling logic and affects every instance of the plugin on any website that has not applied the update.

The CVE’s EPSS score is not publicly available and it is not listed in the CISA KEV catalog, but the lack of authentication and input validation in the webhook endpoint renders the vulnerability highly exploitable by anyone who can reach the WordPress site over the network. The attack requires simply sending a crafted HTTP POST to the plugin’s webhook URL; no special privileges, credentials, or host discovery are needed. Because the flaw permits payment status manipulation without payment, the potential impact includes unauthorized fund disbursement and loss of revenue. Without an official fix or workaround, the risk of exploitation remains high for affected installations.