CVE-2025-14461: Xendit Payment Plugin Auth Bypass Flaw

CVE-2025-14461 Overview

The Xendit Payment plugin for WordPress contains a critical authorization bypass vulnerability that allows unauthenticated attackers to manipulate WooCommerce order statuses. The plugin exposes a publicly accessible WooCommerce API callback endpoint (wc_xendit_callback) that processes payment callbacks without any authentication or cryptographic verification that the requests originate from Xendit's payment gateway.

This broken access control vulnerability (CWE-862) enables attackers to mark any WooCommerce order as paid by sending a crafted POST request to the callback URL. All versions of the plugin up to and including 6.0.2 are affected by this security flaw.

Critical Impact

Attackers can fraudulently mark orders as completed without actual payment, resulting in direct financial loss and inventory depletion for e-commerce businesses.

Affected Products

• Xendit Payment Plugin for WordPress versions ≤ 6.0.2
• WooCommerce installations using the Xendit Payment integration
• WordPress sites with the woo-xendit-virtual-accounts plugin installed

Discovery Timeline

• 2026-02-04 - CVE-2025-14461 published to NVD
• 2026-02-04 - Last updated in NVD database

Technical Details for CVE-2025-14461

Vulnerability Analysis

This vulnerability stems from a fundamental authentication failure in the payment callback handling mechanism. The Xendit Payment plugin implements a callback endpoint (wc_xendit_callback) to receive payment status updates from the Xendit payment gateway. However, this endpoint lacks any form of authentication or cryptographic signature verification to validate that incoming requests genuinely originate from Xendit's servers.

The vulnerability is classified under CWE-862 (Missing Authorization), as the plugin fails to perform any authorization checks before processing payment status updates. When a payment gateway integration is implemented, it's critical that callback endpoints verify the authenticity of incoming requests—typically through HMAC signatures, IP whitelisting, or token-based authentication.

Root Cause

The root cause lies in the callback handler implementation at line 252 of woocommerce-xendit-pg.php. The endpoint accepts and processes incoming POST requests without:

1. Verifying the request signature against a shared secret
2. Validating the source IP address against known Xendit server IPs
3. Implementing any authentication token or API key verification
4. Checking callback authenticity through Xendit's verification API

This design flaw allows any party with knowledge of the callback URL structure to submit forged payment confirmations.

Attack Vector

The attack exploits the unauthenticated callback endpoint through a network-based vector that requires no privileges or user interaction. An attacker can exploit this vulnerability by:

1. Enumerating Order IDs: WooCommerce order IDs are sequential integers, making them trivially enumerable
2. Crafting Malicious Requests: Constructing a POST request to the wc_xendit_callback endpoint with a JSON body containing:
   
   • An external_id field matching the target order ID pattern
   • A status field set to PAID or SETTLED
3. Submitting the Forged Callback: Sending the crafted request to the vulnerable endpoint, which processes it as a legitimate payment confirmation

The plugin then updates the WooCommerce order status to completed, releasing goods or services without any actual payment transaction occurring. For detailed technical analysis, see the Wordfence Vulnerability Analysis and the vulnerable code reference.

Detection Methods for CVE-2025-14461

Indicators of Compromise

• Unexpected order status changes to "Completed" or "Processing" without corresponding payment records in Xendit dashboard
• Suspicious POST requests to /wp-json/ or /?wc-api=wc_xendit_callback endpoints from non-Xendit IP addresses
• Orders marked as paid with missing or invalid transaction IDs in payment metadata
• High volume of sequential order ID requests or callback attempts in access logs

Detection Strategies

• Monitor web server access logs for POST requests to the Xendit callback endpoint from IP addresses outside Xendit's known infrastructure
• Implement alerting for orders that transition to paid status without corresponding webhook logs from the legitimate payment provider
• Cross-reference WooCommerce order completion events with actual payment records in the Xendit merchant dashboard
• Deploy Web Application Firewall (WAF) rules to flag or block suspicious callback requests with anomalous patterns

Monitoring Recommendations

• Enable detailed logging for all WooCommerce order status transitions with source attribution
• Configure real-time alerts for orders exceeding defined value thresholds that are marked as completed
• Implement reconciliation processes to compare WooCommerce orders against Xendit transaction records daily
• Monitor for patterns of sequential order ID probing in server access logs

How to Mitigate CVE-2025-14461

Immediate Actions Required

• Update the Xendit Payment plugin to the latest patched version immediately
• Audit all recent orders for potential fraudulent status changes by comparing with Xendit dashboard records
• Temporarily disable the Xendit payment integration if an update is not immediately available
• Implement IP-based access restrictions on the callback endpoint to allow only Xendit's server IP ranges

Patch Information

The vulnerability affects all versions of the Xendit Payment plugin up to and including 6.0.2. Site administrators should update to the latest available version from the WordPress plugin repository. For detailed code changes, refer to the plugin trunk code.

Workarounds

• Implement server-level IP whitelisting to restrict access to the wc_xendit_callback endpoint to only Xendit's official IP addresses
• Deploy a Web Application Firewall (WAF) rule to validate incoming callback requests against expected patterns and reject suspicious payloads
• Add a custom verification layer that confirms payment status directly with Xendit's API before updating order status
• Consider temporarily switching to an alternative payment gateway until a patched version is available

# Example: Restrict callback endpoint access to Xendit IPs in .htaccess
<Files "woocommerce-xendit-pg.php">
    Order deny,allow
    Deny from all
    # Replace with actual Xendit server IP ranges
    Allow from 52.77.0.0/16
    Allow from 13.250.0.0/16
</Files>