CVE-2026-10599 is an authorization bypass vulnerability in the Integrate PhonePe with WooCommerce plugin (up to version 1.2.1). The plugin does not validate that a verified payment transaction corresponds to the order being marked as paid, nor does it verify the authenticity of payment-completion requests. As a result, unauthenticated attackers can reuse a single valid transaction to mark arbitrary orders as paid, effectively bypassing payment controls. The issue relates to CWE-639 (Authorization Bypass Through User-Controlled Key) and CWE-345 (Insufficient Verification of Data Authenticity).

An attacker can mark arbitrary orders as paid without completing a valid payment, leading to potential financial loss for merchants using the plugin. The integrity of the payment process is compromised, allowing unauthorized order fulfillment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch is currently documented. Until a fix is available, users should consider disabling the plugin or implementing additional verification controls on payment completion requests to prevent unauthorized order status changes.