CVE-2025-11890: WooCommerce Payeer Payment Bypass Flaw

CVE-2025-11890 Overview

CVE-2025-11890 is a payment bypass vulnerability affecting the Crypto Payment Gateway with Payeer for WooCommerce plugin for WordPress in all versions up to and including 1.0.3. The vulnerability stems from improper server-side validation of payment status through the /wc-api/bp-payeer-gateway-callback endpoint, allowing unauthenticated attackers to manipulate order statuses and complete purchases without payment.

Critical Impact
Unauthenticated attackers can bypass payment verification and mark unpaid orders as paid, resulting in direct financial loss for e-commerce merchants using this plugin.

Affected Products

Crypto Payment Gateway with Payeer for WooCommerce plugin versions ≤ 1.0.3
WordPress installations using the vulnerable plugin
WooCommerce stores accepting cryptocurrency payments via Payeer

Discovery Timeline

2025-11-04 - CVE-2025-11890 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-11890

Vulnerability Analysis

This vulnerability is classified as CWE-862 (Missing Authorization), a critical security flaw where the application fails to perform proper authorization checks before granting access to sensitive functionality. In this case, the payment callback endpoint lacks adequate server-side validation to verify the authenticity and legitimacy of payment status updates.

The vulnerable endpoint /wc-api/bp-payeer-gateway-callback is designed to receive payment confirmation callbacks from the Payeer payment gateway. However, the implementation does not properly verify that payment notifications originate from legitimate sources or that payments were actually completed before updating order statuses.

This design flaw allows attackers to craft malicious requests that mimic legitimate payment gateway callbacks, effectively completing orders without transferring any funds.

Root Cause

The root cause is missing authorization and insufficient server-side validation in the payment callback handler. The plugin accepts and processes payment status updates without:

Verifying the request signature or authentication token from the payment gateway
Confirming payment completion through a secondary server-to-server API call to Payeer
Validating that the payment amount matches the order total
Implementing proper nonce or anti-replay mechanisms

This represents a fundamental failure in payment gateway integration security, where client-side or callback data is trusted without independent verification.

Attack Vector

The attack is executed over the network without requiring authentication or user interaction. An attacker can exploit this vulnerability by:

Identifying a WooCommerce store using the Crypto Payment Gateway with Payeer plugin
Placing an order and noting the order ID or reference number
Crafting a malicious HTTP request to the /wc-api/bp-payeer-gateway-callback endpoint
Including parameters that indicate successful payment completion for the target order
The plugin processes the forged callback and marks the order as paid

The attack requires no special privileges and can be performed by any unauthenticated user with knowledge of the vulnerable endpoint structure. Additional technical details are available in the Wordfence Vulnerability Report.

Detection Methods for CVE-2025-11890

Indicators of Compromise

Unusual patterns of orders marked as paid without corresponding payment records in Payeer dashboard
HTTP requests to /wc-api/bp-payeer-gateway-callback from IP addresses not associated with Payeer's infrastructure
Orders completed with mismatched payment references or invalid transaction IDs
Spike in completed orders without revenue increase in payment gateway reports

Detection Strategies

Implement web application firewall (WAF) rules to monitor and log all requests to the payment callback endpoint
Cross-reference WooCommerce order statuses with actual payment records in the Payeer merchant dashboard
Enable detailed logging for the payment callback endpoint to capture request headers, source IPs, and payload data
Deploy anomaly detection to identify unusual order completion patterns or velocity

Monitoring Recommendations

Configure alerts for orders marked as paid from IP addresses outside Payeer's known IP ranges
Set up periodic reconciliation between WooCommerce orders and Payeer transaction records
Monitor server logs for repeated or scripted requests to the callback endpoint
Implement real-time alerting for high-value orders that complete without matching gateway confirmations

How to Mitigate CVE-2025-11890

Immediate Actions Required

Disable the Crypto Payment Gateway with Payeer for WooCommerce plugin until a patched version is available
Audit all recent orders to identify potentially fraudulent transactions completed without actual payment
Switch to an alternative payment gateway with proper server-side validation if cryptocurrency payments are essential
Implement WAF rules to block or challenge requests to the vulnerable callback endpoint

Patch Information

As of the last update, merchants should check the WordPress Plugin Repository for any available updates beyond version 1.0.3. If no patch is available, consider removing the plugin and using an alternative cryptocurrency payment solution that implements proper payment verification.

Workarounds

Temporarily disable the plugin and manually process cryptocurrency payments through the Payeer dashboard
Implement server-side IP whitelisting to only accept callbacks from verified Payeer IP addresses
Add a custom validation layer that performs server-to-server verification with Payeer's API before marking orders as paid
Use a security plugin or WAF to restrict access to the callback endpoint based on request signatures or origin validation

bash

# Example: Block external access to callback endpoint via .htaccess (temporary mitigation)
# Add to WordPress root .htaccess file
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{REQUEST_URI} ^.*wc-api/bp-payeer-gateway-callback.*$ [NC]
RewriteCond %{REMOTE_ADDR} !^(PAYEER_IP_1|PAYEER_IP_2)$
RewriteRule .* - [F,L]
</IfModule>