Direct Payments For Woocommerce
Monthly
Unauthenticated order manipulation in the Direct Payments for WooCommerce WordPress plugin before 2.5.3 enables any remote attacker to forge payment completion states, overwrite payment-method labels, and attach fabricated proof-of-payment files to arbitrary customer orders. The flaw stems from multiple AJAX handlers that process order updates without verifying the requester owns or is otherwise authorized to modify the targeted order. A publicly available proof-of-concept exists and the SSVC framework rates this as automatable, meaningfully amplifying the fraud risk for affected merchants despite the EPSS score of 0.15% (4th percentile).
Unauthenticated order manipulation in the Direct Payments for WooCommerce WordPress plugin before 2.5.3 enables any remote attacker to forge payment completion states, overwrite payment-method labels, and attach fabricated proof-of-payment files to arbitrary customer orders. The flaw stems from multiple AJAX handlers that process order updates without verifying the requester owns or is otherwise authorized to modify the targeted order. A publicly available proof-of-concept exists and the SSVC framework rates this as automatable, meaningfully amplifying the fraud risk for affected merchants despite the EPSS score of 0.15% (4th percentile).