CVE-2024-1718 is a medium severity vulnerability affecting the Claudio Sanches – Checkout Cielo for WooCommerce plugin for WordPress. The issue arises from insufficient validation in the update_order_status() function, allowing unauthenticated attackers to update order statuses to paid without proper payment verification. This can lead to unauthorized order status changes, potentially enabling fraudulent order processing. The vulnerability affects all versions up to and including 1.1.0. No patch or vendor advisory is currently available, and no known exploits have been reported.

An attacker can bypass payment validation and mark orders as paid without completing payment, potentially leading to fraudulent order fulfillment. The vulnerability does not impact confidentiality or availability but affects the integrity of order status data within the affected plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling the plugin or restricting access to the update_order_status() functionality through other means. Monitor official Claudio Sanches or WordPress plugin sources for updates and apply patches promptly once available.