The SUMIT Payment Gateway for WooCommerce plugin prior to version 4.0.0 suffers from improper authentication (CWE-287). Specifically, it fails to verify the authenticity of payment notifications received from the payment provider. As a result, an attacker can send forged payment notifications to the plugin, causing it to mark orders as paid without any real payment transaction occurring.

An attacker can mark pending orders as paid without completing payment, potentially leading to unauthorized order fulfillment and financial loss for the merchant. The vulnerability does not impact confidentiality or availability but allows integrity violations by unauthorized order status changes.

No official patch or fix information is provided in the available data. Since the vulnerability affects versions before 4.0.0, upgrading to version 4.0.0 or later (if available) is recommended once a fix is released. Until then, monitor vendor advisories for updates. No vendor advisory content is provided to confirm patch status, so patch status is not yet confirmed — check the vendor advisory for current remediation guidance.