CVE-2025-14978: PeachPay WooCommerce Auth Bypass Flaw

CVE-2025-14978 Overview

CVE-2025-14978 is a Missing Authorization vulnerability (CWE-862) affecting the PeachPay — Payments & Express Checkout for WooCommerce plugin for WordPress. The vulnerability exists due to missing capability checks on the ConvesioPay webhook REST endpoint in all versions up to and including 1.119.8. This security flaw enables unauthenticated attackers to modify the status of arbitrary WooCommerce orders through the unprotected REST API endpoint.

Critical Impact
Unauthenticated attackers can manipulate WooCommerce order statuses, potentially leading to fraudulent order completion, payment bypass, or order cancellation without proper authorization.

Affected Products

PeachPay — Payments & Express Checkout for WooCommerce plugin versions up to and including 1.119.8
WordPress installations running the vulnerable PeachPay plugin
WooCommerce stores utilizing PeachPay payment integrations (Stripe, PayPal, Square, Authorize.net)

Discovery Timeline

2026-01-20 - CVE CVE-2025-14978 published to NVD
2026-01-20 - Last updated in NVD database

Technical Details for CVE-2025-14978

Vulnerability Analysis

This vulnerability stems from improper access control implementation in the PeachPay plugin's ConvesioPay webhook handler. The REST endpoint responsible for processing webhook callbacks from the ConvesioPay payment service fails to implement proper capability checks, allowing any user—authenticated or not—to invoke the endpoint and modify order data.

The vulnerability is classified under CWE-862 (Missing Authorization), which occurs when software does not perform authorization checks for actors attempting to access resources or functionality. In this case, the webhook endpoint accepts and processes requests without verifying that the caller has the appropriate permissions to modify WooCommerce order statuses.

The attack can be conducted remotely over the network without requiring any user interaction or prior authentication. While the integrity impact is limited to order status modifications (rather than full data compromise), the consequences for e-commerce operations can be significant, including fraudulent order fulfillment or denial of legitimate transactions.

Root Cause

The root cause of this vulnerability is the absence of capability checks in the class-peachpay-convesiopay-webhook.php file. The webhook REST endpoint handler does not verify whether the incoming request originates from a legitimate source or whether the requester has appropriate permissions to modify order data.

Proper WordPress REST API security should include permission_callback functions that verify user capabilities or validate webhook signatures. The vulnerable implementation bypasses these security controls, exposing the endpoint to unauthorized access.

Attack Vector

The attack vector involves sending crafted HTTP requests directly to the ConvesioPay webhook REST endpoint. An attacker can enumerate or guess order IDs and submit requests to change order statuses arbitrarily.

The vulnerability is exploitable through the network with low attack complexity. No authentication credentials or user interaction is required. An attacker could potentially:

Mark unpaid orders as "completed" to receive goods without payment
Cancel legitimate orders to disrupt business operations
Change order statuses to manipulate inventory or financial records

For technical details on the vulnerable code, see the WordPress Plugin Code Review.

Detection Methods for CVE-2025-14978

Indicators of Compromise

Unexpected WooCommerce order status changes without corresponding payment gateway confirmations
Unusual REST API requests targeting /wp-json/ endpoints related to PeachPay or ConvesioPay
Order status modifications occurring outside normal business hours or from suspicious IP addresses
Discrepancies between payment processor records and WooCommerce order statuses

Detection Strategies

Monitor WordPress REST API access logs for unauthenticated requests to PeachPay webhook endpoints
Implement Web Application Firewall (WAF) rules to detect and alert on suspicious webhook traffic patterns
Configure WooCommerce order status change notifications to detect unauthorized modifications
Review server access logs for high-volume requests to plugin REST endpoints from single IP addresses

Monitoring Recommendations

Enable comprehensive logging for all WooCommerce order status transitions
Set up alerts for order status changes that lack corresponding payment gateway webhook verification
Monitor for REST API calls to PeachPay endpoints that do not include valid authentication headers
Cross-reference order modifications with payment processor transaction logs to identify discrepancies

How to Mitigate CVE-2025-14978

Immediate Actions Required

Update the PeachPay — Payments & Express Checkout for WooCommerce plugin to a version newer than 1.119.8 that includes the security fix
Audit recent WooCommerce order history for any unauthorized status modifications
Review server logs for suspicious REST API activity targeting the ConvesioPay webhook endpoint
Consider temporarily disabling the PeachPay plugin if an immediate update is not possible

Patch Information

Organizations should update to the latest patched version of the PeachPay plugin as soon as it becomes available. The vulnerability affects all versions up to and including 1.119.8. For additional vulnerability details and patch status, consult the Wordfence Vulnerability Report.

Workarounds

Implement server-level IP allowlisting to restrict access to the webhook endpoint to known payment gateway IP ranges
Deploy a Web Application Firewall (WAF) rule to block unauthenticated requests to the vulnerable endpoint
Add custom code to implement webhook signature verification if the plugin does not provide this functionality
Consider using a WordPress security plugin to monitor and block suspicious REST API requests

bash

# Example: Apache .htaccess rule to restrict webhook endpoint access
# Add to WordPress root .htaccess file
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{REQUEST_URI} ^/wp-json/peachpay/.*webhook [NC]
    RewriteCond %{REMOTE_ADDR} !^192\.168\.1\. [NC]
    RewriteRule ^ - [F,L]
</IfModule>