Unauthenticated order payment forgery via unchecked return

Payment confirmation bypass in Deema Payment Gateway 1.1.2 and earlier allows remote attackers to mark WooCommerce orders paid without payment. The plugin's hosted-checkout return handler accepts a success return without verifying the transaction with Deema or checking its payment status and amount. An unauthenticated requester who reaches a merchant's checkout return flow can cause an unpaid order to be recorded as paid; broader store access is not established.