The Payment Gateway Based Fees and Discounts for WooCommerce plugin suffers from an unauthenticated insecure direct object reference (IDOR) flaw that permits attackers to access and potentially modify the configuration of payment gateway fees and discounts. Because the plugin fails to enforce proper authorization checks on requests that identify fee/discount objects, an attacker can alter the rules that affect transaction amounts, potentially injecting unapproved fees or discounts.

WordPress sites running the Payment Gateway Based Fees and Discounts for WooCommerce plugin from Tyche Softwares, versions 3.0.0 and older are vulnerable. The plugin is commonly used in WooCommerce shops to calculate gateway‑specific fees, so any site with an out‑of‑date installation is at risk.

The CVSS score is 6.5, indicating moderate severity. No EPSS data is available, and the vulnerability is not listed in CISA’s KEV catalog. The flaw can be exploited by sending crafted HTTP requests containing the identifiers of fee/discount objects. Because the vulnerability is unauthenticated, an attacker with internet access can induce changes to financial transaction rules without legitimate credentials.