CVE-2024-0631 is an improper access control vulnerability (CWE-284) in the Duitku Payment Gateway WordPress plugin by rayhanduitku. The vulnerability exists due to the absence of a capability check in the check_duitku_response function, allowing unauthenticated attackers to change order payment statuses to failed. This affects all plugin versions up to and including 2.11.6. The CVSS 3.1 base score is 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), reflecting network attack vector, low complexity, no privileges required, no user interaction, unchanged scope, no confidentiality or availability impact, but integrity impact is low.

An attacker without authentication can modify the payment status of orders to failed, potentially disrupting order processing and causing denial of legitimate payment confirmations. There is no direct confidentiality or availability impact reported. The integrity of order payment data is compromised, which could affect business operations relying on accurate payment status.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should monitor plugin updates from rayhanduitku and consider restricting access to the affected function or implementing additional access controls if possible. Avoid exposing the payment gateway endpoint to untrusted sources.