The Welcart e-Commerce WordPress plugin prior to version 2.11.33 contains an insufficient verification of data authenticity vulnerability (CWE-345) in its convenience-store and bank-transfer payment callback handling. The plugin does not validate signatures, amounts, or the origin of callback requests, allowing an attacker to send unauthenticated requests that flip an order's status from unpaid to settled based solely on the order number and a status flag. This enables attackers to mark their own unpaid orders as paid and receive goods or services without completing payment.

An attacker can exploit this vulnerability to fraudulently mark unpaid orders as paid, resulting in unauthorized order fulfillment without actual payment. This impacts the integrity of the order payment process but does not directly affect confidentiality or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling convenience-store and bank-transfer payment methods or implementing additional verification controls on callbacks to ensure authenticity.