The iPOSpays Payment Gateway for WooCommerce plugin does not confirm that a payment has actually been completed before marking an order as paid. As a result, an unauthenticated user can send a request that changes an unpaid order to paid and modifies the order total. This allows creation of false payment records and can enable fraudulent payouts or revenue loss for the merchant ownership or the customer business.

All installations of the iPOSpays Payment Gateway for WooCommerce WordPress plugin with a version lower than 1.4.7 are affected. The product is developed and distributed under the iPOSpays branding, and no other vendors or product variants are listed.

The CVSS score of 5.3 indicates a moderate severity that may compromise system integrity. EPSS is not available, so the likelihood of automated exploitation is uncertain, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an unauthenticated HTTP request to the plugin’s payment confirmation endpoint or a related REST API call that does not enforce proper access control. Because the flaw stems from inadequate authentication checks before status changes (CWE-345), an attacker can forge payment confirmations without needing credentials, thereby achieving privilege escalation within the order processing workflow.