This is REALLY bad. You should have given them at least a day to fix it before posting it here though, this is pretty bad etiquette. I understand you're excited you discovered such a stupid mistake but everyone can just pull up my payment details by entering the correct URL now.