An unauthenticated server-side request forgery vulnerability in the Total processing card payments for WooCommerce plugin poses a critical risk by enabling credential theft and fraudulent order processing.

The plugin suffers from a Server-Side Request Forgery (CWE-918) flaw where it fails to validate user-supplied paths and server-side responses. This allows an unauthenticated attacker to manipulate verification requests to reach arbitrary hosts, leading to the disclosure of sensitive payment gateway credentials and the unauthorized modification of order statuses.

This vulnerability carries a CVSS score of 9.1, reflecting its critical severity. Successful exploitation allows attackers to bypass financial controls, potentially leading to direct revenue loss through fraudulent order fulfillment and the catastrophic compromise of merchant payment gateway credentials, which could lead to further downstream financial fraud.

Immediate Action: Since a specific patched version is not yet provided, administrators should immediately deactivate the plugin or restrict access to the affected site until the vendor releases a security update.

Proactive Monitoring: Review web server access logs for anomalous outbound requests to unexpected external domains or unusual patterns in payment verification endpoints.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block unauthorized or suspicious outbound traffic originating from the web server and restrict access to the plugin's verification endpoints.

Public Exploit Available: Unknown

Given the critical nature of this vulnerability and its potential to facilitate direct financial fraud, organizations using this plugin must treat this as a high-priority issue. If an update is not immediately available from the vendor, the only effective way to mitigate this risk is to disable the plugin entirely until a verified patch is installed.