This vulnerability in the Onepay Payment Gateway for WooCommerce arises from missing authorization checks, leading to incorrect access control. It affects all versions up to 1.1.2. The issue allows attackers to exploit the plugin remotely without authentication or user interaction, potentially leading to limited confidentiality and integrity impacts. No official patch or vendor advisory is currently provided, and the plugin is not a cloud service, so remediation depends on vendor updates or user action.

The vulnerability could allow an unauthenticated attacker to access or manipulate certain functions or data within the payment gateway plugin, resulting in limited confidentiality and integrity impacts. There is no indication of availability impact. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix is currently documented, users should monitor for updates from Onepay Sri Lanka and consider restricting access to the plugin or disabling it until a fix is available.