CVE-2025-12903: Braintree WooCommerce Auth Bypass Flaw

CVE-2025-12903 Overview

The Payment Plugins Braintree For WooCommerce plugin for WordPress contains an authorization bypass vulnerability in versions up to and including 3.2.78. The wc-braintree/v1/3ds/vaulted_nonce REST API endpoint registers its permission_callback as __return_true, removing all authentication and capability checks. The endpoint processes user-supplied token IDs without verifying ownership. Unauthenticated attackers can retrieve payment method nonces for any stored payment token in the system. Attackers can then create fraudulent transactions, charge customer credit cards, or attach payment methods to other subscriptions. The flaw is tracked under [CWE-639] (Authorization Bypass Through User-Controlled Key).

Critical Impact
Unauthenticated attackers can retrieve payment nonces for any stored token and use them to initiate fraudulent charges against customer payment methods.

Affected Products

Payment Plugins Braintree For WooCommerce — all versions through 3.2.78
WordPress sites running the woo-payment-gateway plugin
WooCommerce stores using Braintree 3D Secure vaulted payment flows

Discovery Timeline

2025-11-12 - CVE-2025-12903 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-12903

Vulnerability Analysis

The vulnerability resides in the class-wc-braintree-controller-3ds.php REST controller within the Payment Plugins Braintree For WooCommerce plugin. The controller registers the wc-braintree/v1/3ds/vaulted_nonce route with permission_callback set to __return_true, which always evaluates to true. WordPress treats this as an explicit declaration that no authentication or capability check is required. The endpoint accepts a token ID from the request and returns a Braintree payment method nonce associated with that vaulted payment method. Because the handler does not verify that the requesting user owns the token, attackers can iterate or guess token identifiers and obtain valid nonces for arbitrary stored payment methods.

Root Cause

The root cause is a missing capability and ownership check on a sensitive REST endpoint. Setting permission_callback => '__return_true' is the WordPress idiom for a public endpoint, but this route exposes vaulted payment material that should be restricted to the token owner. The handler trusts user-supplied token identifiers as authoritative without correlating them to the authenticated user, a classic Insecure Direct Object Reference pattern.

Attack Vector

An unauthenticated remote attacker sends an HTTP request to /wp-json/wc-braintree/v1/3ds/vaulted_nonce containing a target token ID. The plugin responds with a Braintree payment nonce tied to that token. The attacker then submits the nonce through normal checkout or subscription flows to charge the victim's stored card or attach the payment method to attacker-controlled subscriptions. No user interaction or privileges are required, and the attack is fully scriptable against any exposed storefront. See the Wordfence Vulnerability Analysis and the affected source at the WooCommerce API Class Reference for technical specifics.

Detection Methods for CVE-2025-12903

Indicators of Compromise

Unauthenticated HTTP requests to /wp-json/wc-braintree/v1/3ds/vaulted_nonce from unfamiliar IP addresses or user agents
Bursts of sequential or enumerated token_id values in REST API logs
WooCommerce order entries showing payments using vaulted tokens from sessions that never authenticated
Customer chargebacks or fraud reports correlating to transactions initiated from anomalous IPs

Detection Strategies

Parse web server and WordPress request logs for any access to the wc-braintree/v1/3ds/vaulted_nonce route by clients without a valid session cookie
Alert on REST API responses containing Braintree paymentMethodNonce payloads served to unauthenticated requesters
Correlate payment nonce retrieval events with subsequent order or subscription mutations within short time windows

Monitoring Recommendations

Enable verbose REST API logging in WordPress and forward logs to a centralized analytics platform
Monitor Braintree gateway dashboards for unusual nonce reuse, geographic anomalies, or velocity spikes
Track outbound calls from the WooCommerce host to Braintree APIs and flag deviations from baseline volume

How to Mitigate CVE-2025-12903

Immediate Actions Required

Update the Payment Plugins Braintree For WooCommerce plugin to a version newer than 3.2.78 as soon as the vendor patch is available
Audit Braintree transaction history for fraudulent charges and rotate or invalidate suspect vaulted payment tokens
Restrict access to /wp-json/wc-braintree/v1/ at the web server or WAF layer until the plugin is patched

Patch Information

The vendor pushed updates to the woo-payment-gateway plugin tracked in the WooCommerce Changeset Overview. Administrators should upgrade to the latest released version through the WordPress admin Plugins screen or via WP-CLI. Confirm post-upgrade that the permission_callback for the 3DS routes enforces authentication and ownership checks. See the WordPress REST API Authentication guidance for recommended callback patterns.

Workarounds

Deploy a WAF rule that blocks unauthenticated POST or GET requests to /wp-json/wc-braintree/v1/3ds/vaulted_nonce
Disable the Braintree plugin temporarily on stores that cannot patch immediately
Use a custom mu-plugin to override the route registration and inject an is_user_logged_in() capability check until the official patch is applied

bash

# Example nginx rule to block the vulnerable REST route
location ~* /wp-json/wc-braintree/v1/3ds/vaulted_nonce {
    return 403;
}