The PayU CommercePro Plugin for WordPress before version 3.9.0 does not verify the authenticity of payment-gateway signatures before processing order changes. This missing authorization (CWE-862) allows unauthenticated attackers to modify critical order details such as totals, shipping information, and metadata for arbitrary WooCommerce orders. The vulnerability affects all versions up to and including 3.8.9. There is no vendor advisory or patch information currently available, and no known exploits in the wild have been reported.

An attacker without authentication can tamper with order details in WooCommerce, potentially leading to incorrect order totals, shipping costs, or metadata manipulation. This could disrupt order processing and cause financial discrepancies but does not directly impact confidentiality or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the plugin's order modification interfaces and monitor for suspicious activity related to order changes.