A critical input validation vulnerability in the Order Tip for WooCommerce plugin allows unauthenticated attackers to manipulate transaction amounts, potentially resulting in unauthorized free orders.

The vulnerability exists due to a lack of server-side validation on the data-tip attribute, which permits unauthenticated attackers to inject arbitrary tip amounts. By submitting negative or excessive values, an attacker can bypass pricing logic and successfully checkout with unauthorized discounts.

This flaw carries significant financial risk, as it enables direct manipulation of e-commerce checkout processes. With a CVSS score of 7.5, the vulnerability is categorized as High, reflecting the potential for direct revenue loss and unauthorized inventory depletion. If exploited, it could lead to widespread financial impact and compromise the integrity of the checkout system.

Immediate Action: Update the Order Tip for WooCommerce plugin to the latest version available from the WordPress repository. If a patched version is not immediately available, disable the plugin to prevent exploitation.

Proactive Monitoring: Review transaction logs for anomalous order totals, specifically searching for orders with zero or negative values that do not correspond to legitimate promotional codes.

Compensating Controls: Implement a Web Application Firewall (WAF) to filter malicious requests targeting the checkout flow, although this should be considered a temporary measure until the plugin is updated.

Public Exploit Available: Unknown.

The ability for unauthenticated users to modify order pricing constitutes a high-severity business risk. Administrators should prioritize updating the plugin immediately to ensure that server-side validation is enforced for all tip-related inputs. Failure to patch this vulnerability may result in direct financial exploitation of the e-commerce platform.