The Asaas Gateway for WooCommerce WordPress plugin before version 2.7.8 accepts an empty access token for its payment webhook endpoint and does not verify that the confirmed payment belongs to the order it marks as paid. This omission allows an unauthenticated attacker to send a crafted webhook request that causes any order on the site to be incorrectly marked as paid without a legitimate payment.

All WordPress sites that use the Asaas Gateway for WooCommerce plugin older than version 2.7.8 are vulnerable. The issue is limited to the plugin’s default configuration and applies to any instance that has not been updated or reconfigured to enforce a valid, non‑empty access token for webhook requests.

The CVSS score of 5.3 indicates moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to send a crafted webhook request directly to the plugin’s payment endpoint, which is exposed publicly and does not require authentication. The exploit is straightforward but the overall risk is mitigated by the low exploitation likelihood and the fact that it is limited to sites running versions prior to 2.7.8.