Rupantorpay WordPress Plugin Missing Authorization Vulnerability in Webhook Handling

A vulnerability exists in the Rupantorpay plugin for WordPress, specifically in versions through 2.0.0. The issue arises from a lack of capability checks in the handle_webhook() function, allowing unauthenticated attackers to alter WooCommerce order statuses. This is achieved by sending crafted requests to the WooCommerce API endpoint, exploiting the missing authorization to unauthorizedly modify order data.

Impact

Exploitation of this vulnerability allows for unauthorized changes to WooCommerce order statuses, which could disrupt order management and fulfillment processes.