The Trust Payments Gateway for WooCommerce WordPress plugin before version 3.1.0 fails to verify the authenticity of the payment provider's response when a customer returns from the hosted payment page. As a result, attackers can mark arbitrary orders as paid without any payment being made and retrieve sensitive order and customer details. This flaw is a classic improper authorization issue, allowing unauthenticated users to alter order status and access confidential data.

Affected systems are WordPress sites running the Trust Payments Gateway for WooCommerce plugin earlier than 3.1.0. No vendor supplied a list of sub‑versions, but any earlier release than 3.1.0 inherits the flaw.

The CVSS base score of 6.5 indicates moderate severity, while the EPSS score of <1% suggests a low likelihood of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. Attackers can exploit the flaw by manipulating the payment return URL or forging a response to the return page, so no authentication is required to trigger the payment completion logic. The lack of binding to the specific order or amount makes automated fraud feasible if the attacker can guess or find order identifiers.