Technical impact
The Chikkili‑Google Pay India for WooCommerce plugin, when installed on a WordPress site, fails to validate that a payment notification originates from Google Pay before updating an order’s status to paid. This flaw allows unauthenticated actors to construct a fabricated notification and cause the website to mark any order as paid, even when no payment has occurred. The consequence is the creation of fraudulent orders and the loss of revenue for the merchant, as the funds are never collected.
Affected Systems
Affected installations are WordPress sites that use the Chikkili‑Google Pay India for WooCommerce plugin version 1.0.6 or earlier. The plugin is labeled in the WordPress ecosystem as the “Chikkili‑Google Pay India” integration for WooCommerce. Any WooCommerce store that relies on this plugin for payment processing without a subsequent manual verification step is vulnerable.
Risk and Exploitability
The vulnerability carries a high financial impact due to the potential for widespread fraud, but the available evidence shows an EPSS score of < 1%, is not listed in the CISA KEV catalog, and has a CVSS score of 5.3, indicating moderate severity. The attack is possible over the public internet, with the attacker needing only to send a crafted HTTP request or webhook lacking any authentication. Because the plugin does not perform signature verification, the attacker can trigger the payment completion logic directly. The risk is amplified by the lack of defensive checks, making exploitation straightforward while no credentials or special privileges are required.
