Currently I setup on my website the ability to accept my ERC20 as payment. In order to do this, I am using a plugin from wordpress that will complete this task using two steps.
Depositing the checkout amount into a smart contract that the creator of the plugin built.
Then somehow, interacting with my token contract to approve the amount and approve itself to complete the transaction.
This all requires two transactions on the Ethereum blockchain. My question is, I never approved the plugin's smart contract, so how is it able to do this? Can't anyone create a smart contract to trick a token contract and drain funds from any account?