The UnitechPay WordPress plugin up to version 1.0.6.3 does not verify the authenticity of payment notifications it receives. As a result, an attacker can trigger the webhook endpoint without any authentication and cause the system to mark orders as paid even though no payment was made, or force legitimate orders into a failed state. This flaw combines authentication bypass, missing data authenticity checks, and authorization bypass, enabling remote fraud and disruption of normal order processing.

Any WordPress installation that uses UnitechPay version 1.0.6.3 or earlier is subject to this vulnerability. The weakness resides in the plugin code itself rather than in the underlying WordPress platform, so the risk applies regardless of hosting environment or site configuration.

Because the plugin performs no authentication or verification of incoming webhook requests, an attacker can exploit the flaw by simply sending an HTTP POST request to the webhook URL from anywhere on the internet. The CVSS score of 5.3 indicates a moderate severity issue, while the EPSS score of less than 1% suggests that exploitation is currently unlikely in the wild. The vulnerability is not yet listed in CISA’s KEV catalog. Exploitation requires only basic network access and knowledge of the plugin’s webhook endpoint, making it relatively straightforward for malicious actors to trigger fraudulent payments or disrupt order flows.