CVE-2025-14078: PAYGENT WooCommerce Auth Bypass Flaw

CVE-2025-14078 Overview

CVE-2025-14078 is a Missing Authorization vulnerability affecting the PAYGENT for WooCommerce plugin for WordPress. The vulnerability exists in all versions up to and including 2.4.6 due to missing authorization checks on the paygent_check_webhook function combined with the paygent_permission_callback function unconditionally returning true on line 199. This flaw allows unauthenticated attackers to manipulate payment callbacks and modify order statuses by sending forged payment notifications via the /wp-json/paygent/v1/check/ REST API endpoint.

Critical Impact

Unauthenticated attackers can forge payment notifications to manipulate WooCommerce order statuses, potentially leading to fraudulent order fulfillment, financial losses, and disruption of e-commerce operations.

Affected Products

• PAYGENT for WooCommerce plugin for WordPress versions up to and including 2.4.6
• WordPress sites utilizing the WooCommerce e-commerce platform with the PAYGENT payment gateway integration
• WooCommerce stores processing payments through the PAYGENT payment service

Discovery Timeline

• 2026-01-17 - CVE-2025-14078 published to NVD
• 2026-01-17 - Last updated in NVD database

Technical Details for CVE-2025-14078

Vulnerability Analysis

This vulnerability is classified as CWE-862 (Missing Authorization). The core issue stems from a flawed implementation in the WordPress REST API permission callback mechanism. The paygent_permission_callback function, located on line 199 of class-wc-paygent-endpoint.php, unconditionally returns true regardless of the authentication state of the requesting user. This effectively bypasses all authorization requirements for the associated REST API endpoint.

When combined with the lack of additional authorization checks within the paygent_check_webhook function itself, this creates a situation where any unauthenticated user can send arbitrary requests to the /wp-json/paygent/v1/check/ endpoint. The endpoint is designed to receive webhook notifications from the PAYGENT payment gateway to update order statuses, but without proper validation of the request origin, attackers can craft forged payment notifications.

Root Cause

The root cause of this vulnerability is the improper implementation of WordPress REST API permission callbacks. In WordPress, REST API endpoints can define a permission_callback argument that should validate whether the current user has authorization to access the endpoint. By returning true unconditionally in the paygent_permission_callback function, the developer effectively disabled all authorization controls for the webhook endpoint.

Proper implementation would require verification that:

1. The request originates from legitimate PAYGENT payment servers
2. The webhook payload contains valid authentication tokens or signatures
3. The request IP address matches known PAYGENT infrastructure

Attack Vector

An attacker can exploit this vulnerability remotely over the network without requiring any authentication or user interaction. The attack involves sending crafted HTTP POST requests to the vulnerable REST API endpoint /wp-json/paygent/v1/check/. By forging payment notification payloads that mimic legitimate PAYGENT webhook responses, attackers can manipulate order statuses in the WooCommerce database.

The exploitation mechanism involves:

1. Identifying a target WordPress site running the vulnerable PAYGENT for WooCommerce plugin
2. Enumerating or guessing valid WooCommerce order IDs
3. Crafting HTTP POST requests to /wp-json/paygent/v1/check/ with forged payment success notifications
4. Submitting the forged webhooks to change order statuses from "pending" to "completed" without actual payment

Detailed technical information and source code can be reviewed in the WordPress Plugin Code Reference.

Detection Methods for CVE-2025-14078

Indicators of Compromise

• Unusual volume of HTTP POST requests to /wp-json/paygent/v1/check/ from non-PAYGENT IP addresses
• Order status changes from "pending" to "completed" without corresponding payment gateway transaction records
• WooCommerce orders marked as paid with no actual funds received in the merchant payment account
• Access logs showing requests to the webhook endpoint from unexpected geographic locations

Detection Strategies

• Monitor web server access logs for requests to /wp-json/paygent/v1/check/ and correlate with legitimate PAYGENT payment gateway IP ranges
• Implement anomaly detection for WooCommerce order status transitions that lack corresponding payment processor confirmation
• Review WordPress REST API activity logs for unauthenticated requests to payment-related endpoints
• Cross-reference completed orders with actual payment receipts in the PAYGENT merchant dashboard

Monitoring Recommendations

• Configure web application firewall (WAF) rules to alert on suspicious traffic patterns to payment webhook endpoints
• Enable comprehensive logging for all WooCommerce order status changes with source IP tracking
• Set up automated reconciliation between WooCommerce order completions and PAYGENT transaction records
• Implement real-time alerting for orders completed without matching payment gateway confirmations

How to Mitigate CVE-2025-14078

Immediate Actions Required

• Update the PAYGENT for WooCommerce plugin to a patched version immediately
• Audit recent WooCommerce orders for discrepancies between order status and actual payment receipt
• Implement IP whitelisting at the web server or WAF level to restrict access to the webhook endpoint to legitimate PAYGENT IP ranges
• Review all orders completed in the affected timeframe and verify payment status directly with PAYGENT

Patch Information

Security patches have been released for this vulnerability. Administrators should update to the latest version of the PAYGENT for WooCommerce plugin available through the WordPress plugin repository. The fix addresses the authorization bypass by implementing proper permission checks in the callback function.

For technical details on the code changes, refer to:

• WordPress Plugin Changeset Update
• Wordfence Vulnerability Report

Workarounds

• Implement IP-based access restrictions at the web server level to allow only PAYGENT payment gateway IP addresses to access the webhook endpoint
• Deploy a web application firewall (WAF) rule to validate webhook request signatures before allowing access
• Temporarily disable the REST API endpoint if the plugin cannot be immediately updated and payment processing can be paused
• Enable WordPress audit logging plugins to track all REST API requests for forensic analysis

# Example Apache .htaccess configuration to restrict webhook endpoint access
# Place in WordPress root directory
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{REQUEST_URI} ^/wp-json/paygent/v1/check/ [NC]
RewriteCond %{REMOTE_ADDR} !^xxx\.xxx\.xxx\.xxx$
RewriteRule .* - [F,L]
</IfModule>
# Replace xxx.xxx.xxx.xxx with legitimate PAYGENT gateway IP addresses