The Conekta Payment Gateway WordPress plugin versions prior to 6.2.2 contain an access control weakness (CWE-284) where incoming payment gateway webhook notifications are not properly authenticated. Additionally, the plugin does not verify that the payment corresponds to the targeted order or that the payment amount is correct. As a result, attackers can exploit this vulnerability to fraudulently mark orders as paid without completing a legitimate transaction.

An attacker can mark arbitrary orders as paid without submitting a valid payment, potentially leading to financial loss for merchants using the vulnerable plugin. This could allow unauthorized order fulfillment or service delivery without actual payment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should monitor for updates from the plugin vendor and avoid relying on this plugin version for critical payment processing. Implement additional verification controls outside the plugin if possible.