Pay With MetaMask For WooCommerce < 1.7.3 - Unauthenticated Order Payment Bypass

Description

The plugin is vulnerable to a payment bypass due to the transaction verification function accepting a caller-supplied amount and reading the receiver address from global plugin settings rather than from trusted order metadata, allowing the expected payment parameters to be manipulated by the client. This makes it possible for unauthenticated attackers to mark WooCommerce orders as paid without completing a valid on-chain payment matching the order's expected receiver, amount, and token contract.