CVE-2025-14978: PeachPay WooCommerce Auth Bypass Flaw

CVE-2025-14978 Overview

CVE-2025-14978 is a Missing Authorization vulnerability (CWE-862) affecting the PeachPay — Payments & Express Checkout for WooCommerce plugin for WordPress. The vulnerability exists due to missing capability checks on the ConvesioPay webhook REST endpoint in all versions up to and including 1.119.8. This security flaw enables unauthenticated attackers to modify the status of arbitrary WooCommerce orders through the unprotected REST API endpoint.

Critical Impact

Unauthenticated attackers can manipulate WooCommerce order statuses, potentially leading to fraudulent order completion, payment bypass, or order cancellation without proper authorization.

Affected Products

• PeachPay — Payments & Express Checkout for WooCommerce plugin versions up to and including 1.119.8
• WordPress installations running the vulnerable PeachPay plugin
• WooCommerce stores utilizing PeachPay payment integrations (Stripe, PayPal, Square, Authorize.net)

Discovery Timeline

• 2026-01-20 - CVE CVE-2025-14978 published to NVD
• 2026-01-20 - Last updated in NVD database

Technical Details for CVE-2025-14978

Vulnerability Analysis

This vulnerability stems from improper access control implementation in the PeachPay plugin's ConvesioPay webhook handler. The REST endpoint responsible for processing webhook callbacks from the ConvesioPay payment service fails to implement proper capability checks, allowing any user—authenticated or not—to invoke the endpoint and modify order data.

The vulnerability is classified under CWE-862 (Missing Authorization), which occurs when software does not perform authorization checks for actors attempting to access resources or functionality. In this case, the webhook endpoint accepts and processes requests without verifying that the caller has the appropriate permissions to modify WooCommerce order statuses.

The attack can be conducted remotely over the network without requiring any user interaction or prior authentication. While the integrity impact is limited to order status modifications (rather than full data compromise), the consequences for e-commerce operations can be significant, including fraudulent order fulfillment or denial of legitimate transactions.

Root Cause

The root cause of this vulnerability is the absence of capability checks in the class-peachpay-convesiopay-webhook.php file. The webhook REST endpoint handler does not verify whether the incoming request originates from a legitimate source or whether the requester has appropriate permissions to modify order data.

Proper WordPress REST API security should include permission_callback functions that verify user capabilities or validate webhook signatures. The vulnerable implementation bypasses these security controls, exposing the endpoint to unauthorized access.

Attack Vector

The attack vector involves sending crafted HTTP requests directly to the ConvesioPay webhook REST endpoint. An attacker can enumerate or guess order IDs and submit requests to change order statuses arbitrarily.

The vulnerability is exploitable through the network with low attack complexity. No authentication credentials or user interaction is required. An attacker could potentially:

1. Mark unpaid orders as "completed" to receive goods without payment
2. Cancel legitimate orders to disrupt business operations
3. Change order statuses to manipulate inventory or financial records

For technical details on the vulnerable code, see the WordPress Plugin Code Review.

Detection Methods for CVE-2025-14978

Indicators of Compromise

• Unexpected WooCommerce order status changes without corresponding payment gateway confirmations
• Unusual REST API requests targeting /wp-json/ endpoints related to PeachPay or ConvesioPay
• Order status modifications occurring outside normal business hours or from suspicious IP addresses
• Discrepancies between payment processor records and WooCommerce order statuses

Detection Strategies

• Monitor WordPress REST API access logs for unauthenticated requests to PeachPay webhook endpoints
• Implement Web Application Firewall (WAF) rules to detect and alert on suspicious webhook traffic patterns
• Configure WooCommerce order status change notifications to detect unauthorized modifications
• Review server access logs for high-volume requests to plugin REST endpoints from single IP addresses

Monitoring Recommendations

• Enable comprehensive logging for all WooCommerce order status transitions
• Set up alerts for order status changes that lack corresponding payment gateway webhook verification
• Monitor for REST API calls to PeachPay endpoints that do not include valid authentication headers
• Cross-reference order modifications with payment processor transaction logs to identify discrepancies

How to Mitigate CVE-2025-14978

Immediate Actions Required

• Update the PeachPay — Payments & Express Checkout for WooCommerce plugin to a version newer than 1.119.8 that includes the security fix
• Audit recent WooCommerce order history for any unauthorized status modifications
• Review server logs for suspicious REST API activity targeting the ConvesioPay webhook endpoint
• Consider temporarily disabling the PeachPay plugin if an immediate update is not possible

Patch Information

Organizations should update to the latest patched version of the PeachPay plugin as soon as it becomes available. The vulnerability affects all versions up to and including 1.119.8. For additional vulnerability details and patch status, consult the Wordfence Vulnerability Report.

Workarounds

• Implement server-level IP allowlisting to restrict access to the webhook endpoint to known payment gateway IP ranges
• Deploy a Web Application Firewall (WAF) rule to block unauthenticated requests to the vulnerable endpoint
• Add custom code to implement webhook signature verification if the plugin does not provide this functionality
• Consider using a WordPress security plugin to monitor and block suspicious REST API requests

# Example: Apache .htaccess rule to restrict webhook endpoint access
# Add to WordPress root .htaccess file
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{REQUEST_URI} ^/wp-json/peachpay/.*webhook [NC]
    RewriteCond %{REMOTE_ADDR} !^192\.168\.1\. [NC]
    RewriteRule ^ - [F,L]
</IfModule>