MAJOR ISSUE? Abuse of AJAX to place FREE Orders

Not sure what is happening but this is occurring right now in real time.

ZenCart 2.2 / OPC 2.7.0 / Bootstrap Template 3.7.9

Had a customer place two different orders, somehow submitting them as both the "freecharger" and a "Gift Certificate/Coupon" payment method.

It's for a digital download product, so they then get access to it even though they didn't submit payment.

I removed the freecharger payment module, and that is when the second order popped up as a "Gift Certificate/Coupon" order, even though they didn't redeem any coupon or gift certificate codes.

The associated log files during this time are these:

[12-Nov-2026 14:05:54 America/Los_Angeles] Request URI: /store/ajax.php?act=ajaxPayment&method=prepareConfirmation, IP address: 166.88.178.130, Language id 1

#0 /includes/classes/ajax/zcAjaxPayment.php(79): zen_debug_error_handler()

#1 /ajax.php(104): zcAjaxPayment->prepareConfirmation()

--> PHP Warning: Undefined array key "comments" in /includes/classes/ajax/zcAjaxPayment.php on line 79.

[12-Nov-2026 14:05:54 America/Los_Angeles] Request URI: /store/ajax.php?act=ajaxPayment&method=prepareConfirmation, IP address: 166.88.178.130, Language id 1

#0 /includes/classes/payment.php(174): zen_debug_error_handler()

#1 /includes/classes/payment.php(195): payment->isPaymentModuleMethodPresent()

#2 /includes/classes/ajax/zcAjaxPayment.php(87): payment->update_status()

#3 /ajax.php(104): zcAjaxPayment->prepareConfirmation()

--> PHP Warning: Undefined global variable $freecharger in /includes/classes/payment.php on line 174.

[12-Nov-2026 14:05:55 America/Los_Angeles] Request URI: /store/index.php?main_page=checkout_process, IP address: 166.88.178.130, Language id 1

#0 [internal function]: zen_debug_error_handler()

#1 /includes/modules/checkout_process.php(87): strpos()

#2 /includes/modules/pages/checkout_process/header_php.php(13): require('/home/domain/...')

#3 /index.php(40): require('/home/domain/...')

--> PHP Deprecated: strpos(): Passing null to parameter #1 ($haystack) of type string is deprecated in /includes/modules/checkout_process.php on line 87.

[12-Nov-2026 14:05:55 America/Los_Angeles] Request URI: /store/index.php?main_page=checkout_process, IP address: 166.88.178.130, Language id 1

#0 /includes/modules/checkout_process.php(87): zen_debug_error_handler()

#1 /includes/modules/pages/checkout_process/header_php.php(13): require('/home/domain/...')

#2 /index.php(40): require('/home/domain/...')

--> PHP Warning: Undefined global variable $freecharger in /includes/modules/checkout_process.php on line 87.

[12-Nov-2026 14:05:55 America/Los_Angeles] Request URI: /store/index.php?main_page=checkout_process, IP address: 166.88.178.130, Language id 1

#0 /includes/modules/checkout_process.php(87): zen_debug_error_handler()

#1 /includes/modules/pages/checkout_process/header_php.php(13): require('/home/domain/...')

#2 /index.php(40): require('/home/domain/...')

--> PHP Warning: Attempt to read property "code" on null in /includes/modules/checkout_process.php on line 87.

[12-Nov-2026 14:05:55 America/Los_Angeles] Request URI: /store/index.php?main_page=checkout_process, IP address: 166.88.178.130, Language id 1

#0 /includes/classes/payment.php(174): zen_debug_error_handler()

#1 /includes/classes/payment.php(379): payment->isPaymentModuleMethodPresent()

#2 /includes/modules/checkout_process.php(110): payment->before_process()

#3 /includes/modules/pages/checkout_process/header_php.php(13): require('/home/domain/...')

#4 /index.php(40): require('/home/domain/...')

--> PHP Warning: Undefined global variable $freecharger in /includes/classes/payment.php on line 174.

[12-Nov-2026 14:05:55 America/Los_Angeles] Request URI: /store/index.php?main_page=checkout_process, IP address: 166.88.178.130, Language id 1

#0 /includes/classes/payment.php(174): zen_debug_error_handler()

#1 /includes/classes/payment.php(401): payment->isPaymentModuleMethodPresent()

#2 /includes/modules/checkout_process.php(123): payment->after_order_create()

#3 /includes/modules/pages/checkout_process/header_php.php(13): require('/home/domain/...')

#4 /index.php(40): require('/home/domain/...')

--> PHP Warning: Undefined global variable $freecharger in /includes/classes/payment.php on line 174.

[12-Nov-2026 14:05:55 America/Los_Angeles] Request URI: /store/index.php?main_page=checkout_process, IP address: 166.88.178.130, Language id 1

#0 /includes/classes/order.php(1433): zen_debug_error_handler()

#1 /includes/modules/checkout_process.php(130): order->send_order_email()

#2 /includes/modules/pages/checkout_process/header_php.php(13): require('/home/domain/...')

#3 /index.php(40): require('/home/domain/...')

--> PHP Warning: Undefined global variable $freecharger in /includes/classes/order.php on line 1433.

[12-Nov-2026 14:05:57 America/Los_Angeles] Request URI: /store/index.php?main_page=checkout_process, IP address: 166.88.178.130, Language id 1

#0 /includes/classes/payment.php(174): zen_debug_error_handler()

#1 /includes/classes/payment.php(390): payment->isPaymentModuleMethodPresent()

#2 /includes/modules/pages/checkout_process/header_php.php(16): payment->after_process()

#3 /index.php(40): require('/home/domain/...')

--> PHP Warning: Undefined global variable $freecharger in /includes/classes/payment.php on line 174.

Attaching a screenshot of the order too.