CVE-2025-11890: WooCommerce Payeer Payment Bypass Flaw

CVE-2025-11890 Overview

CVE-2025-11890 is a payment bypass vulnerability affecting the Crypto Payment Gateway with Payeer for WooCommerce plugin for WordPress in all versions up to and including 1.0.3. The vulnerability stems from improper server-side validation of payment status through the /wc-api/bp-payeer-gateway-callback endpoint, allowing unauthenticated attackers to manipulate order statuses and complete purchases without payment.

Critical Impact

Unauthenticated attackers can bypass payment verification and mark unpaid orders as paid, resulting in direct financial loss for e-commerce merchants using this plugin.

Affected Products

• Crypto Payment Gateway with Payeer for WooCommerce plugin versions ≤ 1.0.3
• WordPress installations using the vulnerable plugin
• WooCommerce stores accepting cryptocurrency payments via Payeer

Discovery Timeline

• 2025-11-04 - CVE-2025-11890 published to NVD
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-11890

Vulnerability Analysis

This vulnerability is classified as CWE-862 (Missing Authorization), a critical security flaw where the application fails to perform proper authorization checks before granting access to sensitive functionality. In this case, the payment callback endpoint lacks adequate server-side validation to verify the authenticity and legitimacy of payment status updates.

The vulnerable endpoint /wc-api/bp-payeer-gateway-callback is designed to receive payment confirmation callbacks from the Payeer payment gateway. However, the implementation does not properly verify that payment notifications originate from legitimate sources or that payments were actually completed before updating order statuses.

This design flaw allows attackers to craft malicious requests that mimic legitimate payment gateway callbacks, effectively completing orders without transferring any funds.

Root Cause

The root cause is missing authorization and insufficient server-side validation in the payment callback handler. The plugin accepts and processes payment status updates without:

1. Verifying the request signature or authentication token from the payment gateway
2. Confirming payment completion through a secondary server-to-server API call to Payeer
3. Validating that the payment amount matches the order total
4. Implementing proper nonce or anti-replay mechanisms

This represents a fundamental failure in payment gateway integration security, where client-side or callback data is trusted without independent verification.

Attack Vector

The attack is executed over the network without requiring authentication or user interaction. An attacker can exploit this vulnerability by:

1. Identifying a WooCommerce store using the Crypto Payment Gateway with Payeer plugin
2. Placing an order and noting the order ID or reference number
3. Crafting a malicious HTTP request to the /wc-api/bp-payeer-gateway-callback endpoint
4. Including parameters that indicate successful payment completion for the target order
5. The plugin processes the forged callback and marks the order as paid

The attack requires no special privileges and can be performed by any unauthenticated user with knowledge of the vulnerable endpoint structure. Additional technical details are available in the Wordfence Vulnerability Report.

Detection Methods for CVE-2025-11890

Indicators of Compromise

• Unusual patterns of orders marked as paid without corresponding payment records in Payeer dashboard
• HTTP requests to /wc-api/bp-payeer-gateway-callback from IP addresses not associated with Payeer's infrastructure
• Orders completed with mismatched payment references or invalid transaction IDs
• Spike in completed orders without revenue increase in payment gateway reports

Detection Strategies

• Implement web application firewall (WAF) rules to monitor and log all requests to the payment callback endpoint
• Cross-reference WooCommerce order statuses with actual payment records in the Payeer merchant dashboard
• Enable detailed logging for the payment callback endpoint to capture request headers, source IPs, and payload data
• Deploy anomaly detection to identify unusual order completion patterns or velocity

Monitoring Recommendations

• Configure alerts for orders marked as paid from IP addresses outside Payeer's known IP ranges
• Set up periodic reconciliation between WooCommerce orders and Payeer transaction records
• Monitor server logs for repeated or scripted requests to the callback endpoint
• Implement real-time alerting for high-value orders that complete without matching gateway confirmations

How to Mitigate CVE-2025-11890

Immediate Actions Required

• Disable the Crypto Payment Gateway with Payeer for WooCommerce plugin until a patched version is available
• Audit all recent orders to identify potentially fraudulent transactions completed without actual payment
• Switch to an alternative payment gateway with proper server-side validation if cryptocurrency payments are essential
• Implement WAF rules to block or challenge requests to the vulnerable callback endpoint

Patch Information

As of the last update, merchants should check the WordPress Plugin Repository for any available updates beyond version 1.0.3. If no patch is available, consider removing the plugin and using an alternative cryptocurrency payment solution that implements proper payment verification.

Workarounds

• Temporarily disable the plugin and manually process cryptocurrency payments through the Payeer dashboard
• Implement server-side IP whitelisting to only accept callbacks from verified Payeer IP addresses
• Add a custom validation layer that performs server-to-server verification with Payeer's API before marking orders as paid
• Use a security plugin or WAF to restrict access to the callback endpoint based on request signatures or origin validation

# Example: Block external access to callback endpoint via .htaccess (temporary mitigation)
# Add to WordPress root .htaccess file
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{REQUEST_URI} ^.*wc-api/bp-payeer-gateway-callback.*$ [NC]
RewriteCond %{REMOTE_ADDR} !^(PAYEER_IP_1|PAYEER_IP_2)$
RewriteRule .* - [F,L]
</IfModule>