CVE-2025-13371: MoneySpace WordPress Information Disclosure

CVE-2025-13371 Overview

The MoneySpace plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.13.9. This vulnerability stems from a critical design flaw where the plugin stores full payment card details—including Primary Account Number (PAN), card holder name, expiry month/year, and CVV—in WordPress post_meta using only base64_encode() for encoding. These sensitive values are then embedded directly into the publicly accessible mspaylink page's inline JavaScript without any authentication or authorization checks.

This severe vulnerability allows unauthenticated attackers who know or can guess an order_id to access the mspaylink endpoint and retrieve complete credit card numbers and CVV codes directly from the HTML/JavaScript response. This constitutes a severe PCI-DSS violation and represents a significant threat to e-commerce sites using this payment gateway integration.

Critical Impact

Unauthenticated attackers can retrieve complete credit card details including full card numbers and CVV codes from publicly accessible WordPress pages, representing a catastrophic data breach risk and severe PCI-DSS compliance violation.

Affected Products

• MoneySpace plugin for WordPress versions up to and including 2.13.9
• WordPress sites using MoneySpace for WooCommerce payment processing
• Any WooCommerce installation with the vulnerable MoneySpace plugin enabled

Discovery Timeline

• 2026-01-07 - CVE CVE-2025-13371 published to NVD
• 2026-01-08 - Last updated in NVD database

Technical Details for CVE-2025-13371

Vulnerability Analysis

This vulnerability represents a fundamental failure in secure payment data handling practices. The MoneySpace plugin violates multiple foundational security principles by storing sensitive cardholder data in an insecure manner and exposing it through publicly accessible endpoints.

The root issue involves two critical failures working in tandem. First, the plugin stores complete payment card information (PAN, cardholder name, expiry date, and CVV) in WordPress post_meta fields using only base64_encode() as a protection mechanism. Base64 encoding is not encryption—it is a simple encoding scheme that can be trivially reversed by anyone. Second, this encoded data is then rendered directly into inline JavaScript on the mspaylink page without requiring any form of authentication or authorization verification.

The attack vector is network-based and requires no user interaction or special privileges. An attacker simply needs to enumerate or guess valid order_id values to access the corresponding payment information. Given that order IDs in WooCommerce are typically sequential integers, enumeration is straightforward.

Root Cause

The vulnerability exists in the mspaylink.php view file, specifically in how payment data is retrieved from post_meta storage and rendered to the page. The code retrieves base64-encoded payment credentials and decodes them directly into JavaScript variables on a publicly accessible page. There is no session validation, capability check, or nonce verification before exposing this data.

The use of base64_encode() for storing payment credentials indicates a fundamental misunderstanding of cryptographic security. Base64 is an encoding scheme designed for data transmission, not data protection. This approach fails to meet even the most basic PCI-DSS requirements for cardholder data protection.

Attack Vector

The attack can be executed by any unauthenticated user with network access to the WordPress site. The attacker can construct requests to the mspaylink endpoint with different order_id parameters to harvest payment card data. The attack flow involves:

1. Identifying a WordPress site using the MoneySpace plugin
2. Accessing the mspaylink page with an order_id parameter
3. Examining the page source or JavaScript variables to extract base64-encoded payment data
4. Decoding the base64 values to obtain plaintext card numbers, CVV codes, expiry dates, and cardholder names

Technical analysis of the vulnerable code can be found in the GitHub Code Review and the WordPress Plugin Code repository.

Detection Methods for CVE-2025-13371

Indicators of Compromise

• Unusual access patterns to mspaylink.php endpoints with sequential or enumerated order_id values
• High volume of requests from single IP addresses targeting mspaylink pages
• Web server logs showing requests to /wp-content/plugins/money-space/view/mspaylink.php from unfamiliar sources
• Evidence of automated scanning tools probing order endpoints with incrementing ID values

Detection Strategies

• Monitor web server access logs for suspicious access patterns to MoneySpace plugin endpoints
• Implement rate limiting on the mspaylink endpoint to detect enumeration attempts
• Deploy Web Application Firewall (WAF) rules to identify and block sequential order ID probing
• Review WordPress audit logs for unauthenticated access to payment-related pages

Monitoring Recommendations

• Enable detailed access logging for all requests to WooCommerce and payment plugin endpoints
• Set up alerts for unusual traffic volumes to mspaylink.php pages
• Implement anomaly detection for order ID access patterns outside normal customer behavior
• Monitor for any base64-encoded strings appearing in outbound network traffic that may indicate data exfiltration

How to Mitigate CVE-2025-13371

Immediate Actions Required

• Disable or remove the MoneySpace plugin immediately if running version 2.13.9 or earlier
• Audit all stored post_meta entries for payment card data and purge any sensitive cardholder information
• Review access logs to identify potential unauthorized access to the mspaylink endpoint
• Notify affected customers if evidence of data exposure is found and initiate incident response procedures
• Engage PCI-DSS compliance team to assess breach notification requirements

Patch Information

As of the NVD publication date, site administrators should monitor the Wordfence Vulnerability Report and the official WordPress plugin repository for security updates. Until a patched version is available, the plugin should not be used in production environments.

Organizations using this plugin should contact MoneySpace directly regarding remediation timelines and consider alternative payment gateway solutions that follow PCI-DSS compliant data handling practices.

Workarounds

• Remove the MoneySpace plugin entirely and switch to a PCI-DSS compliant payment gateway integration
• Implement server-level access controls to restrict access to the mspaylink.php endpoint to authenticated users only
• Deploy a WAF rule to block unauthenticated requests to /wp-content/plugins/money-space/view/mspaylink.php
• If the plugin must remain active temporarily, remove stored payment card data from post_meta and disable new card storage

# Configuration example - Apache .htaccess rule to block public access to vulnerable endpoint
<Files "mspaylink.php">
    Order Deny,Allow
    Deny from all
    # Allow only authenticated admin access via specific IP
    # Allow from YOUR.ADMIN.IP.ADDRESS
</Files>