Unauthenticated payment bypass via transaction ID reuse

Payment bypass in Integrate PhonePe with WooCommerce 1.2.1 and earlier allows remote attackers to mark arbitrary orders as paid. The payment-completion handler accepts independent client-supplied order and transaction identifiers, verifies only that the transaction succeeded, and marks the selected order paid without authenticating the request or binding that transaction to the order. One valid transaction identifier and a reachable callback are sufficient to reuse a payment across orders, causing goods or services to appear paid without corresponding payment.