Order disclosure via unsigned notify redirect

Sensitive data exposure in Duitku Payment Gateway for WooCommerce 2.11.14 and earlier allows remote attackers to view order details via a crafted notify request. The check_duitku_response() handler routes requests with status=notify into notify_response() before any signature validation, and notify_response() accepts a supplied merchantOrderId and redirects to that order's get_checkout_order_received_url(), exposing the order key and receipt page. No authentication is required, but the attacker needs a valid order identifier or prefixed merchantOrderId; the exposure is limited to whatever the WooCommerce order-received page reveals for that order.