Unauthorized order cancellation via nonce bypass

Broken authentication in Flutterwave WooCommerce through 3.3.0 allows remote attackers to cancel orders via crafted payment-verification requests. In flw_verify_payment(), the callback gate uses !isset($_GET['_wpnonce']) && !wp_verify_nonce(...), so any request that merely supplies the _wpnonce parameter bypasses nonce validation; the handler then trusts tx_ref, derives the order ID from it, and calls the cancel path when status=cancelled. Exploitation requires network reachability to the public WooCommerce API endpoint and knowledge of a valid transaction reference for the target order; observed impact is unauthorized order cancellation and related order-state changes rather than full site compromise.