Unauthenticated order payment bypass via unvalidated status notifications

Payment validation bypass in Checkout Cielo for WooCommerce 1.1.0 and earlier allows remote attackers to mark unpaid orders as paid. The update_order_status() function treats an unauthenticated status notification as proof of payment without validating its authenticity. No WordPress account is required, and a forged notification triggers paid-order processing despite the absence of a validated Cielo payment.