## https://sploitus.com/exploit?id=WPEX-ID:09CE3ADE-80FC-438B-8976-852A273D7C53 As unauthenticated, see the source of https://example.com/?pay_for_order=true&order-pay=80 (80 being a valid order number)