The PeachPay plugin for WooCommerce suffers from a missing authorization (CWE-862) vulnerability on its ConvesioPay webhook REST endpoint. This lack of capability checks enables unauthenticated attackers to alter the status of WooCommerce orders arbitrarily. The issue affects all versions up to and including 1.119.8. The CVSS 3.1 base score is 5.3 (medium), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and no availability impact. No known exploits are reported in the wild. No patch or vendor advisory is currently available to confirm remediation status.

An attacker can modify the status of arbitrary WooCommerce orders without authentication, potentially disrupting order processing or causing incorrect order states. There is no direct confidentiality or availability impact reported. The integrity of order data is affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider restricting access to the webhook endpoint or implementing custom authorization checks if possible. Monitor vendor channels for an official patch or update.