CVE-2024-0619 is a missing authorization vulnerability in the Payflex Payment Gateway WordPress plugin by tomlister. The issue arises because the payment_callback() function lacks a capability check, enabling unauthenticated attackers to update order statuses arbitrarily. This can lead to unauthorized modification of payment data and potentially impact business revenue. The vulnerability affects all versions up to and including 2.5.0. There is no vendor advisory or patch currently available, and the plugin is not a cloud service.

An attacker without authentication can modify the status of orders processed through the Payflex Payment Gateway plugin. This unauthorized modification can lead to financial impact such as revenue loss due to fraudulent order status changes. There is no indication of confidentiality or availability impact. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the payment_callback() endpoint via web application firewall rules or other access controls to prevent unauthenticated requests. Monitor for updates from the vendor and apply patches promptly once available.