CVE-2025-7820 affects the SKT PayPal for WooCommerce plugin for WordPress, versions up to and including 1.4. The vulnerability arises because the plugin enforces payment controls only on the client side, failing to validate payments on the server side. This design flaw enables unauthenticated attackers to bypass payment verification and complete purchases without actual payment confirmation. The issue is categorized as CWE-602 (Client-Side Enforcement of Server-Side Security). The CVSS 3.1 base score is 7.5, indicating a high severity vulnerability with network attack vector, low attack complexity, no privileges required, and no user interaction needed. The impact affects integrity but not confidentiality or availability.

An attacker can exploit this vulnerability to make confirmed purchases without paying, compromising the integrity of the payment process. This can lead to financial loss for merchants using the affected plugin. There is no impact on confidentiality or availability reported. The vulnerability does not require authentication or user interaction, increasing its risk.

Patch status is not yet confirmed — no official fix or patch has been documented for this vulnerability. Users of the SKT PayPal for WooCommerce plugin should monitor the vendor's advisories for updates. Until a fix is available, consider disabling the plugin or using alternative payment processing solutions that enforce server-side payment validation. Avoid relying on client-side controls for critical security functions such as payment verification.