CVE-2025-12355: Payaza WordPress Plugin Auth Bypass Flaw

CVE-2025-12355 Overview

CVE-2025-12355 affects the Payaza plugin for WordPress in all versions up to and including 0.3.8. The plugin exposes the wp_ajax_nopriv_update_order_status AJAX endpoint without a capability check. Unauthenticated attackers can invoke the endpoint over the network to modify order statuses on affected sites. The issue is classified under CWE-862: Missing Authorization and impacts data integrity on WooCommerce-style order workflows integrated with Payaza.

Critical Impact
Unauthenticated remote attackers can alter order status values, enabling order-state tampering that may impact fulfillment, refunds, and payment reconciliation on affected WordPress stores.

Affected Products

Payaza plugin for WordPress, all versions up to and including 0.3.8
WordPress sites exposing the wp_ajax_nopriv_update_order_status action
E-commerce deployments using Payaza for payment processing

Discovery Timeline

2025-12-05 - CVE-2025-12355 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-12355

Vulnerability Analysis

The Payaza plugin registers an AJAX handler through the WordPress wp_ajax_nopriv_update_order_status hook. Handlers registered with the nopriv_ prefix are reachable by unauthenticated visitors through admin-ajax.php. The handler updates order status values but does not verify the caller's capabilities or validate a nonce tied to a privileged session. As a result, any anonymous HTTP client can send crafted requests that trigger order status changes.

The impact is limited to integrity of order state. Confidentiality and availability are not directly affected, but downstream business logic that trusts the order status field may take incorrect actions. Attackers could mark unpaid orders as paid, revert completed orders, or spam status changes to disrupt merchant workflows.

Root Cause

The root cause is a missing authorization check [CWE-862] on a server-side state-changing endpoint. The plugin relies on the AJAX action name being obscure, rather than enforcing current_user_can() checks and check_ajax_referer() nonce validation. Registering the action under wp_ajax_nopriv_ explicitly exposes it to unauthenticated users, compounding the missing check.

Attack Vector

Exploitation requires only network access to the target site's admin-ajax.php endpoint. An attacker sends an HTTP POST request specifying action=update_order_status along with the parameters the handler consumes, such as an order identifier and target status. No authentication, user interaction, or elevated privileges are required. The vulnerability is reachable from any Internet-connected client that can reach the WordPress installation.

No verified public proof-of-concept code is available. Refer to the Wordfence Vulnerability Report for additional technical context.

Detection Methods for CVE-2025-12355

Indicators of Compromise

Unauthenticated POST requests to /wp-admin/admin-ajax.php containing action=update_order_status from unexpected source IPs
Order records showing status transitions without a corresponding authenticated admin session in WordPress logs
Bursts of AJAX traffic targeting the Payaza plugin endpoints from a single IP or user agent
Order status changes occurring outside normal business hours or without matching payment gateway callbacks

Detection Strategies

Enable request logging on the web server and alert on admin-ajax.php POSTs where the action parameter equals update_order_status and no valid authentication cookie is present
Correlate WordPress order status change events with authenticated admin activity to identify state changes without a matching user session
Deploy web application firewall (WAF) rules that inspect POST bodies for the vulnerable action name and block or challenge anonymous callers

Monitoring Recommendations

Ingest WordPress and web server access logs into a centralized SIEM for query and correlation
Baseline normal order status change frequency per site and alert on statistical anomalies
Monitor for the plugin version reported by readme.txt or the WordPress plugin API to confirm affected installations remain patched

How to Mitigate CVE-2025-12355

Immediate Actions Required

Inventory all WordPress sites for the Payaza plugin and identify installations at version 0.3.8 or earlier via the WordPress Plugin Page
Update the Payaza plugin to a fixed version as soon as the vendor publishes one, or disable and remove the plugin if a patch is not yet available
Restrict access to admin-ajax.php behind a WAF rule that blocks the update_order_status action from unauthenticated sources
Audit recent order status changes and reconcile against payment gateway records to identify any tampering

Patch Information

At the time of publication, no fixed version is documented in the referenced advisories. Monitor the Wordfence Vulnerability Report and the WordPress Plugin Page for a release that adds capability and nonce checks to the affected AJAX handler.

Workarounds

Deactivate the Payaza plugin until a patched version is available and manually process pending payments
Add a mu-plugin that removes the wp_ajax_nopriv_update_order_status action, forcing authentication on the handler
Deploy WAF virtual patching to reject POST requests to admin-ajax.php where action=update_order_status and no valid session cookie exists

bash

# Example WAF rule (ModSecurity) to block anonymous calls to the vulnerable action
SecRule REQUEST_URI "@endsWith /wp-admin/admin-ajax.php" \
    "chain,phase:2,deny,status:403,id:1012355,\
    msg:'CVE-2025-12355 Payaza update_order_status blocked'"
SecRule ARGS:action "@streq update_order_status" \
    "chain"
SecRule &REQUEST_COOKIES:/wordpress_logged_in_/ "@eq 0"