Wordpress Alert: Payment status spoofing

A payment integration accepts an unverified completion signal. An unpaid order may appear paid or be fulfilled.

Switchboard Tech Services

Wordpress Alert: Payment status spoofing

What it looks like

A payment integration accepts an unverified completion signal.

Why it matters

An unpaid order may appear paid or be fulfilled.

What to check

Verify provider notifications before changing order status.

Documentation

This is an exploit pattern to check in installed components, not a claim that every WordPress site has this flaw. Confirm the product and version against its advisories before treating a site as affected. See WooCommerce orders API, WooCommerce security FAQ.