CVE-2025-14978

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-14978", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-12-19T16:06:55.163Z", "datePublished": "2026-01-20T01:22:45.405Z", "dateUpdated": "2026-04-08T16:53:21.706Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:53:21.706Z"}, "affected": [{"vendor": "peachpay", "product": "PeachPay \u2014 Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI)", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.119.8", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The PeachPay \u2014 Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability checks on the ConvesioPay webhook REST endpoint in all versions up to, and including, 1.119.8. This makes it possible for unauthenticated attackers to modify the status of arbitrary WooCommerce orders."}], "title": "PeachPay \u2014 Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net) <= 1.119.8 - Missing Authorization to Unauthenticated Order Status Modification", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5480a151-3e3a-46ba-9712-6c61fba06812?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/peachpay-for-woocommerce/tags/1.119.5/core/payments/convesiopay/routes/class-peachpay-convesiopay-webhook.php#L33"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-862 Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Md. Moniruzzaman Prodhan"}], "timeline": [{"time": "2025-12-13T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2025-12-19T16:22:34.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-01-19T13:14:59.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-20T20:54:04.723575Z", "id": "CVE-2025-14978", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-20T20:54:26.888Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-14978", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-20T20:54:04.723575Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-20T20:54:10.416Z"}}], "cna": {"title": "PeachPay \u2014 Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net) <= 1.119.8 - Missing Authorization to Unauthenticated Order Status Modification", "credits": [{"lang": "en", "type": "finder", "value": "Md. Moniruzzaman Prodhan"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "peachpay", "product": "PeachPay \u2014 Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI)", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.119.8"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-12-13T00:00:00.000Z", "value": "Discovered"}, {"lang": "en", "time": "2025-12-19T16:22:34.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-01-19T13:14:59.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5480a151-3e3a-46ba-9712-6c61fba06812?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/peachpay-for-woocommerce/tags/1.119.5/core/payments/convesiopay/routes/class-peachpay-convesiopay-webhook.php#L33"}], "descriptions": [{"lang": "en", "value": "The PeachPay \u2014 Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability checks on the ConvesioPay webhook REST endpoint in all versions up to, and including, 1.119.8. This makes it possible for unauthenticated attackers to modify the status of arbitrary WooCommerce orders."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:53:21.706Z"}}}, "cveMetadata": {"cveId": "CVE-2025-14978", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:53:21.706Z", "dateReserved": "2025-12-19T16:06:55.163Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-01-20T01:22:45.405Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "PeachPay \u2014 Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI)", "vendor": "peachpay", "versions": [{"lessThanOrEqual": "1.119.8", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The PeachPay \u2014 Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability checks on the ConvesioPay webhook REST endpoint in all versions up to, and including, 1.119.8. This makes it possible for unauthenticated attackers to modify the status of arbitrary WooCommerce orders."}, {"lang": "es", "value": "El plugin PeachPay \u2014 Payments &amp; Express Checkout para WooCommerce (compatible con Stripe, PayPal, Square, Authorize.net) para WordPress es vulnerable a la modificaci\u00f3n no autorizada de datos debido a la falta de controles de capacidad en el endpoint REST del webhook de ConvesioPay en todas las versiones hasta la 1.119.8, inclusive. Esto posibilita que atacantes no autenticados modifiquen el estado de \u00f3rdenes arbitrarias de WooCommerce."}], "id": "CVE-2025-14978", "lastModified": "2026-06-17T08:36:52.843", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-14978", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-20T20:54:04.723575Z", "version": "2.0.3"}}]}, "published": "2026-01-20T02:15:45.873", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/peachpay-for-woocommerce/tags/1.119.5/core/payments/convesiopay/routes/class-peachpay-convesiopay-webhook.php#L33"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5480a151-3e3a-46ba-9712-6c61fba06812?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T23:56:26.531945+00:00", "value": {"mitigation_remediation": ["Upgrade PeachPay to the latest version available, which includes the fix for the missing capability checks on the ConvesioPay webhook endpoint.", "If an immediate update is not possible, block the webhook endpoint from unauthenticated traffic\u2014e.g., place a basic\u2011auth layer or firewall rule that allows requests only from the trusted server that sends the webhook.", "Re\u2011issue and rotate any ConvesioPay webhook credentials so that only the newly authenticated credentials can reach the endpoint."], "summary": {"action": "Patch Immediately", "impact": "Unauthorized Order Status Modification"}, "threat_synthesis": {"affected_systems": "The affected product is PeachPay\u202f\u2014\u202fPayments\u202f&\u202fExpress Checkout for WooCommerce, a WordPress plugin that supports Stripe, PayPal, Square, Authorize.net, and NMI. Versions 1.119.8 and earlier are vulnerable; all later releases should contain a fix.", "description_and_impact": "The vulnerability stems from missing capability checks on the ConvesioPay webhook REST endpoint in the PeachPay\u202f\u2014\u202fPayments\u202f&\u202fExpress Checkout for WooCommerce plugin up to version\u202f1.119.8. Because the endpoint validates no user permissions, an unauthenticated attacker can send a crafted webhook payload and alter the status of any WooCommerce order. This violates the principle of least authority (CWE\u2011862) and compromises order integrity, potentially enabling fraudulent order cancellations, refunds, or shipping approvals.", "risk_and_exploitability": "The CVSS score of 5.3 indicates medium risk, while the EPSS score of less than 1\u202f% suggests a low likelihood of current exploitation. However, the vulnerability is not listed in CISA KEV, meaning no documented active exploitation is known. An attacker can exploit the flaw by sending an unauthenticated HTTP request to the webhook endpoint; no additional credentials or privileged access are required. Because an attacker can modify any order, the impact on confidentiality is low, but integrity and potentially financial loss are significant."}}}}, "created": "2026-01-20T08:40:10.096521+00:00", "updated": "2026-04-22T00:00:03.952905+00:00", "vendors": ["peachpay", "peachpay$PRODUCT$peachpay_-_payments_&_express_checkout_for_woocommerce_(supports_stripe,_paypal,_square,_authorizenet)", "wordpress", "wordpress$PRODUCT$wordpress"]}