The elegro Crypto Payment WordPress plugin, in all releases up to version 1.0.1, fails to enforce a shared secret when processing inbound payment notification requests. This omission allows an attacker that does not possess any authentic credentials to forge an IPN callback and modify the status of any order on a target site. The flaw is a classic example of improper authorization and can be used to arbitrarily cancel orders, mark payments as complete, or otherwise manipulate transaction data, resulting in financial fraud or revenue loss.

WordPress installations that have installed the elegro Crypto Payment plugin version 1.0.1 or earlier and have left the shared‑secret configuration field empty are affected. No Common Platform Enumeration strings are supplied in the CVE data.

The CVSS score is 6.5 and the EPSS score is <1%, but the vulnerability permits direct manipulation of order status without any authentication, indicating a moderate‑severity risk. The exploitation path consists of a simple forged HTTP to the plugin’s IPN callback endpoint; no prior credentials or privileged access are required. Because the flaw is entirely driven by external input, the likelihood of exploitation is substantial for sites still using the default empty secret configuration. The vulnerability is not listed in the CISA KEV catalog at this time.