CVE-2025-58634: PeachPay Authorization Bypass Vulnerability

CVE-2025-58634 Overview

CVE-2025-58634 is a missing authorization vulnerability [CWE-862] in the PeachPay Payments plugin for WooCommerce, developed by peachpay. The flaw affects all versions of peachpay-for-woocommerce up through 1.117.4. The plugin exposes functionality protected by incorrectly configured access control security levels, allowing unauthenticated network-based attackers to reach restricted actions.

Successful exploitation results in a limited integrity impact on affected WordPress sites running the plugin. No user interaction or privileges are required to trigger the issue. Store operators using PeachPay Payments should treat this as an actionable broken access control weakness within the WooCommerce payment workflow.

Critical Impact
Unauthenticated attackers can invoke restricted plugin functionality over the network, tampering with data protected by broken access controls.

Affected Products

PeachPay Payments plugin (peachpay-for-woocommerce) versions up to and including 1.117.4
WordPress sites running WooCommerce with the PeachPay Payments extension installed
All deployments where the plugin is active regardless of hosting environment

Discovery Timeline

2025-09-03 - CVE-2025-58634 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-58634

Vulnerability Analysis

The vulnerability is a Missing Authorization weakness classified under [CWE-862]. The PeachPay Payments plugin exposes one or more endpoints or actions without verifying that the requesting user holds the required capability or role. Access control security levels are incorrectly configured, meaning the plugin relies on assumptions about the caller's identity rather than enforcing capability checks server-side.

An attacker sends a crafted HTTP request over the network to reach the affected functionality. Because the vulnerability requires no authentication and no user interaction, it can be exploited directly against internet-facing WordPress stores. The impact is limited to integrity, meaning attackers can modify data or trigger state changes exposed by the vulnerable code path but cannot directly extract confidential data or crash the site through this flaw.

The EPSS probability is 0.209% with a percentile of 11.089, indicating limited observed exploitation activity to date. However, WordPress plugin authorization flaws are frequently weaponized once details become public.

Root Cause

The root cause is the absence of authorization checks on one or more plugin actions. In WordPress plugins, these checks typically take the form of current_user_can() capability verification, nonce validation via check_ajax_referer(), or REST route permission_callback handlers. When these controls are missing or incorrectly configured, any caller — including anonymous visitors — can reach privileged functionality.

Attack Vector

Exploitation occurs over the network against the WordPress site's HTTP interface. An attacker identifies the vulnerable plugin endpoint, typically an admin-ajax.php action or a REST API route registered by PeachPay Payments, and issues a request without credentials. See the Patchstack advisory for advisory-level detail on the affected functionality.

No verified proof-of-concept code has been published. The vulnerability mechanism is described in prose only per available advisory data.

Detection Methods for CVE-2025-58634

Indicators of Compromise

Unauthenticated HTTP POST or GET requests to admin-ajax.php or /wp-json/ routes registered by the PeachPay plugin
Unexpected modifications to WooCommerce order, payment, or plugin configuration data without a corresponding authenticated admin session
Repeated requests from a single IP enumerating PeachPay plugin actions or REST endpoints

Detection Strategies

Review WordPress and web server access logs for anonymous requests targeting PeachPay endpoints and correlate with WooCommerce data changes
Deploy a web application firewall rule set that flags unauthenticated requests to plugin-specific AJAX actions and REST routes
Audit installed plugin versions across WordPress fleets and flag any installation of peachpay-for-woocommerce at or below version 1.117.4

Monitoring Recommendations

Enable WooCommerce order and settings audit logging to establish a baseline for legitimate write activity
Alert on new admin users, modified payment gateway configuration, or altered plugin options originating from unauthenticated sessions
Monitor outbound requests from the WordPress host that may indicate secondary abuse of tampered payment configuration

How to Mitigate CVE-2025-58634

Immediate Actions Required

Identify all WordPress sites running the PeachPay Payments plugin and confirm the installed version
Update peachpay-for-woocommerce to a version later than 1.117.4 as soon as the vendor publishes a fixed release
If no fixed version is available, disable and remove the plugin until a patch is released

Patch Information

The vulnerability affects PeachPay Payments through version 1.117.4. Administrators should consult the Patchstack advisory for the current fixed version and vendor guidance. Apply plugin updates through the WordPress admin console or via WP-CLI once the patched release is available.

Workarounds

Deactivate the PeachPay Payments plugin on affected stores until a patched version is applied
Restrict access to admin-ajax.php and wp-json endpoints associated with the plugin using web application firewall rules
Enforce IP allowlisting on WordPress administrative and REST paths where feasible

bash

# Check installed PeachPay Payments version and update via WP-CLI
wp plugin get peachpay-for-woocommerce --field=version
wp plugin update peachpay-for-woocommerce
# If no patch is available, deactivate the plugin
wp plugin deactivate peachpay-for-woocommerce