CVE-2025-14971: WooCommerce Plugin Auth Bypass Flaw

CVE-2025-14971 Overview

CVE-2025-14971 affects the Link Invoice Payment for WooCommerce plugin for WordPress through version 2.8.0. The plugin fails to enforce capability checks on the createPartialPayment and cancelPartialPayment functions inside WcPaymentInvoiceEndpoint.php. Unauthenticated attackers can create partial payments on arbitrary orders or cancel existing partial payments by enumerating order identifiers. The flaw is classified as Missing Authorization under [CWE-862].

Critical Impact

Remote, unauthenticated attackers can modify WooCommerce order payment state, disrupting merchant order processing and financial reconciliation.

Affected Products

• Link Invoice Payment for WooCommerce plugin for WordPress
• All versions up to and including 2.8.0
• WordPress sites running WooCommerce with this plugin installed

Discovery Timeline

• 2026-01-27 - CVE-2025-14971 published to the National Vulnerability Database
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-14971

Vulnerability Analysis

The vulnerability resides in the plugin's REST endpoint handler WcPaymentInvoiceEndpoint.php. Two endpoint callbacks, createPartialPayment and cancelPartialPayment, are registered without proper capability checks or nonce validation. WordPress conventions require that state-changing endpoints validate the caller's permissions through current_user_can() or an equivalent permission_callback. The plugin omits these checks, so any HTTP client can invoke the functions.

Attackers exploit the flaw by sending crafted requests that reference WooCommerce order IDs. Because order IDs are sequential integers, attackers enumerate valid orders programmatically. Each successful request either inserts a fraudulent partial payment record or cancels a legitimate one, corrupting the order ledger and the merchant's view of paid balances.

The scope is limited to data integrity. Confidentiality and availability are not directly impacted, but downstream effects include incorrect fulfillment, disputed refunds, and accounting drift.

Root Cause

The root cause is a missing authorization check on REST API callbacks. The register_rest_route call lacks a restrictive permission_callback, allowing anonymous access to functions that should require administrative or shop-manager privileges. See the WordPress Plugin Code Review at line 19 and the createPartialPayment handler at line 179.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker sends HTTP POST requests to the plugin's REST routes, supplying enumerated order IDs and payment parameters. No special tooling is needed beyond a standard HTTP client. The Wordfence Vulnerability Analysis provides additional context on exploitation requirements.

Detection Methods for CVE-2025-14971

Indicators of Compromise

• Unexpected partial payment entries on WooCommerce orders with no corresponding customer session or admin action
• Cancellation of legitimate partial payments without a matching audit log entry
• Anonymous HTTP requests to plugin REST routes referencing createPartialPayment or cancelPartialPayment
• Sequential order ID access patterns from a single source address indicating enumeration

Detection Strategies

• Audit WooCommerce order metadata for partial payment records created outside business hours or without an authenticated user context
• Review web server access logs for unauthenticated POST requests to /wp-json/ paths registered by the Link Invoice Payment plugin
• Compare the order payment ledger against the merchant gateway's settlement records to find unmatched partial payment entries

Monitoring Recommendations

• Enable WordPress audit logging that captures REST API requests, source IP, and authenticated user identity
• Alert on bursts of requests touching multiple sequential WooCommerce order IDs from the same client
• Forward web server and WordPress logs to a centralized analytics platform to correlate REST activity with order state changes

How to Mitigate CVE-2025-14971

Immediate Actions Required

• Identify all WordPress sites running the Link Invoice Payment for WooCommerce plugin and confirm the installed version
• Disable the plugin on any site running version 2.8.0 or earlier until a patched release is installed
• Reconcile recent WooCommerce orders against gateway settlement reports to identify fraudulent or canceled partial payments
• Restrict access to /wp-json/ endpoints at the web application firewall (WAF) layer for unauthenticated clients

Patch Information

No patched version is referenced in the available advisory data. Administrators should monitor the plugin page on WordPress.org and the Wordfence Vulnerability Analysis for the fixed release. Upgrade to a version later than 2.8.0 once available and verify that the createPartialPayment and cancelPartialPayment endpoints enforce a restrictive permission_callback.

Workarounds

• Deactivate and remove the plugin until a fixed version is released
• Deploy WAF rules blocking unauthenticated requests to the plugin's REST routes
• Use WordPress role and capability hardening plugins to require authentication on all /wp-json/ traffic where feasible
• Monitor and manually approve partial payment changes through database-level review until patched

# Example WAF rule to block unauthenticated requests to the vulnerable endpoints
# (adjust to match your WAF syntax)
SecRule REQUEST_URI "@rx /wp-json/.*(createPartialPayment|cancelPartialPayment)" \
    "id:1014971,phase:1,deny,status:403,\
     msg:'Block unauthenticated access to Link Invoice Payment endpoints (CVE-2025-14971)',\
     chain"
    SecRule &REQUEST_HEADERS:Cookie "@eq 0"