CVE-2026-10599 is an authorization bypass vulnerability in the Integrate PhonePe with WooCommerce plugin for WordPress, affecting versions through 1.2.1. The plugin does not validate that a verified payment transaction corresponds to the order being marked as paid, nor does it verify the authenticity of payment-completion requests. Consequently, an unauthenticated attacker can reuse a single valid transaction to mark arbitrary orders as paid, effectively bypassing payment controls. The vulnerability is tracked under CWE-639 (Authorization Bypass Through User-Controlled Key) and CWE-345 (Insufficient Verification of Data Authenticity). The CVSS v3.1 base score is 7.5 (High), with network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact. No patch or official remediation is currently documented.

An attacker can mark arbitrary orders as paid without completing a valid payment, leading to potential financial loss and unauthorized order fulfillment. The integrity of the payment process is compromised, but confidentiality and availability are not affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider disabling the plugin or restricting access to payment-completion endpoints to trusted users only. Monitor for updates from the plugin vendor regarding an official fix.