The Paymentfor Gateway for WooCommerce plugin before version 1.0.6 fails to verify the authenticity of inbound payment notifications before marking an order as paid. This flaw allows unauthenticated attackers to forge payment callbacks and set order status to paid without any real transaction, leading to revenue loss and inventory mismanagement.

The vulnerability affects installations of the Paymentfor Gateway for WooCommerce WordPress plugin running any version earlier than 1.0.6. Users running this plugin on a WordPress site are at risk.

The CVSS score of 5.3 indicates a moderate severity. The EPSS score of less than 1% suggests a low likelihood of exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves sending a crafted, unauthenticated payment notification to the plugin endpoint. Successful exploitation would require only the ability to target the plugin’s callback URL, and the impact is confined to orders processed by the plugin.