The Booster for WooCommerce plugin, used in WordPress websites, has a security vulnerability that allows people with an account and at least a ‘subscriber’ level of permission to modify their own orders. This includes the ability to mark the orders as paid even if they have not paid for them. This vulnerability is present in versions 5.6.2 (free) and 5.6.0 (premium) of the plugin.