The Direct Payments for WooCommerce WordPress plugin prior to version 2.5.3 fails to verify that the requester owns the targeted WooCommerce order in multiple unauthenticated AJAX handlers. This improper access control (CWE-284) enables unauthenticated attackers to modify order status and payment metadata arbitrarily. Attackers can forge a 'payment sent' state, overwrite payment method labels, and attach forged payment-proof files to orders they do not own.

An attacker can tamper with other customers' orders without authentication, potentially causing confusion in order processing and payment verification. This could lead to fraudulent order states and payment information, undermining trust in the payment system and possibly causing financial or operational issues for merchants using the plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to AJAX handlers where possible and monitor for suspicious activity related to order status changes. Avoid using vulnerable versions in production environments.