When I manually call:

https://site.com/paypal/success?txn_id=12345&first_name=Vojta&last_name=Svoboda&payment_gross=100&payment_status=paid&payment_date=2017-11-21

The order will be created, or not? Is there some payment confirmation? Or anybody can create any order by this URL?

In the code I do not see any protection. Bump