The Deema Payment Gateway WordPress plugin fails to verify the payment provider’s confirmation when processing the hosted checkout return. As a result, unauthenticated users can submit a completed payment return and have their orders marked as paid without any actual payment being captured. This flaw allows attackers to forge payment confirmations, potentially leading to financial loss and unauthorized access to purchased goods or services.

WordPress sites installing Deema Payment Gateway plugin version 1.1.2 or earlier are affected. No additional vendor or version details are available.

The vulnerability is exploitable via an unauthenticated HTTP request to the checkout return URL, a path that is likely accessible from a browser or scripted client. The CVSS score of 5.3 indicates a medium severity. The EPSS score is < 1%, indicating a very low but nonzero exploitation probability, and the issue is not listed in the CISA KEV catalog, suggesting limited publicly documented exploitation. Nevertheless, the ability to mark orders as paid without authentication poses a high financial risk. Attackers could theoretically act as if transactions have completed, potentially eroding revenue and customer trust.