CVE-2025-14971

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-14971", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-12-19T13:39:27.943Z", "datePublished": "2026-01-27T06:44:13.511Z", "dateUpdated": "2026-04-08T17:10:16.758Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:10:16.758Z"}, "affected": [{"vendor": "linknacional", "product": "Link Invoice Payment for WooCommerce", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.8.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Link Invoice Payment for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the createPartialPayment and cancelPartialPayment functions in all versions up to, and including, 2.8.0. This makes it possible for unauthenticated attackers to create partial payments on any order or cancel any existing partial payment via ID enumeration."}], "title": "Link Invoice Payment for WooCommerce <= 2.8.0 - Missing Authorization to Unauthenticated Arbitrary Partial Payment Creation/Cancellation", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/96a8fc8b-6f0a-486c-89d1-7211b4ca31bd?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/invoice-payment-for-woocommerce/tags/2.8.0/Includes/WcPaymentInvoiceEndpoint.php#L19"}, {"url": "https://plugins.trac.wordpress.org/browser/invoice-payment-for-woocommerce/tags/2.8.0/Includes/WcPaymentInvoiceEndpoint.php#L179"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-862 Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Md. Moniruzzaman Prodhan"}], "timeline": [{"time": "2025-12-13T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2025-12-22T12:22:35.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-01-26T18:22:41.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-27T20:48:58.538767Z", "id": "CVE-2025-14971", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-27T20:49:11.856Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-14971", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-27T20:48:58.538767Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-27T20:49:06.454Z"}}], "cna": {"title": "Link Invoice Payment for WooCommerce <= 2.8.0 - Missing Authorization to Unauthenticated Arbitrary Partial Payment Creation/Cancellation", "credits": [{"lang": "en", "type": "finder", "value": "Md. Moniruzzaman Prodhan"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "linknacional", "product": "Link Invoice Payment for WooCommerce", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "2.8.0"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-12-13T00:00:00.000+00:00", "value": "Discovered"}, {"lang": "en", "time": "2025-12-22T12:22:35.000+00:00", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-01-26T18:22:41.000+00:00", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/96a8fc8b-6f0a-486c-89d1-7211b4ca31bd?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/invoice-payment-for-woocommerce/tags/2.8.0/Includes/WcPaymentInvoiceEndpoint.php#L19"}, {"url": "https://plugins.trac.wordpress.org/browser/invoice-payment-for-woocommerce/tags/2.8.0/Includes/WcPaymentInvoiceEndpoint.php#L179"}], "descriptions": [{"lang": "en", "value": "The Link Invoice Payment for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the createPartialPayment and cancelPartialPayment functions in all versions up to, and including, 2.8.0. This makes it possible for unauthenticated attackers to create partial payments on any order or cancel any existing partial payment via ID enumeration."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-01-27T06:44:13.511Z"}}}, "cveMetadata": {"cveId": "CVE-2025-14971", "state": "PUBLISHED", "dateUpdated": "2026-01-27T20:49:11.856Z", "dateReserved": "2025-12-19T13:39:27.943Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-01-27T06:44:13.511Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Link Invoice Payment for WooCommerce", "vendor": "linknacional", "versions": [{"lessThanOrEqual": "2.8.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Link Invoice Payment for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the createPartialPayment and cancelPartialPayment functions in all versions up to, and including, 2.8.0. This makes it possible for unauthenticated attackers to create partial payments on any order or cancel any existing partial payment via ID enumeration."}, {"lang": "es", "value": "El plugin Link Invoice Payment para WooCommerce para WordPress es vulnerable a la modificaci\u00f3n no autorizada de datos debido a una falta de verificaci\u00f3n de capacidad en las funciones createPartialPayment y cancelPartialPayment en todas las versiones hasta la 2.8.0, inclusive. Esto hace posible que atacantes no autenticados creen pagos parciales en cualquier pedido o cancelen cualquier pago parcial existente mediante enumeraci\u00f3n de ID."}], "id": "CVE-2025-14971", "lastModified": "2026-06-17T08:36:52.050", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-14971", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-27T20:48:58.538767Z", "version": "2.0.3"}}]}, "published": "2026-01-27T07:16:05.880", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/invoice-payment-for-woocommerce/tags/2.8.0/Includes/WcPaymentInvoiceEndpoint.php#L179"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/invoice-payment-for-woocommerce/tags/2.8.0/Includes/WcPaymentInvoiceEndpoint.php#L19"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/96a8fc8b-6f0a-486c-89d1-7211b4ca31bd?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T16:09:21.039802+00:00", "value": {"mitigation_remediation": ["Upgrade to the latest version of Link Invoice Payment for WooCommerce (>=2.8.1) which includes the missing capability checks in the createPartialPayment and cancelPartialPayment functions.", "If an upgrade is not immediately possible, temporarily disable the createPartialPayment and cancelPartialPayment endpoints in the plugin or remove the corresponding routes to prevent unauthenticated access.", "Implement an additional capability check or authentication guard on these endpoints to ensure that only users with the appropriate WooCommerce payment permissions can create or cancel partial payments.", "Review the plugin's configuration and remove any exposed endpoints or options that allow partial payment manipulation without proper authorization."], "summary": {"action": "Apply Patch", "impact": "Unauthorized Partial Payment Creation/Cancelation"}, "threat_synthesis": {"affected_systems": "The affected product is the Link Invoice Payment for WooCommerce plugin for WordPress, any version up to and including 2.8.0.", "description_and_impact": "The vulnerability exists because the plugin's createPartialPayment and cancelPartialPayment functions lack a required capability check, allowing anyone without authentication to invoke these endpoints. This missing authorization permits the creation of arbitrary partial payments for any order and the cancellation of existing partial payments via simple ID enumeration, thereby enabling manipulation of order balances and potential financial fraud.", "risk_and_exploitability": "The CVSS score of 5.3 indicates moderate severity, but the EPSS score of <1% suggests a very low likelihood of exploitation in the wild. The vulnerability is not currently listed in the CISA KEV catalog. Based on the missing capability check, an attacker can exploit the flaw by sending unauthenticated HTTP requests to the plugin\u2019s partial payment endpoints, potentially enumerating payment IDs and creating or cancelling partial payments without credentials."}}}}, "created": "2026-01-27T20:16:56.418546+00:00", "updated": "2026-04-21T16:15:40.504289+00:00", "vendors": ["linknacional", "linknacional$PRODUCT$link_invoice_payment_for_woocommerce", "woocommerce", "woocommerce$PRODUCT$woocommerce", "wordpress", "wordpress$PRODUCT$wordpress"]}