The Deema Payment Gateway plugin for WordPress, versions up to and including 1.1.2, fails to verify the authenticity of payment processor notifications. Because the verification mechanism is disabled by default, an attacker can send crafted webhook requests to the plugin’s endpoint and alter order status, marking an unpaid purchase as paid, canceling an order, or initiating a refund. This flaw represents missing authentication checks (CWE‑287). By manipulating transactional data, an attacker can gain financial benefit or disrupt e‑commerce operations.

The only affected product is the Deema Payment Gateway WordPress plugin, versions up to and including 1.1.2. The vulnerability applies to any WordPress site that installs this plugin; no specific operating system or hosting environment is required beyond the standard WordPress stack.

The CVSS rating of 5.3 classifies the flaw as medium severity, while the EPSS score of less than 1 percent indicates a low probability of exploitation at this time. Nevertheless, because the vulnerability allows an unauthenticated attacker to alter financial records over the public internet, the potential impact is significant. No official resolution is documented; administrators should monitor vendor advisories for a fix or mitigate by blocking the webhook endpoint.