CVE-2025-62754: bKash for WC Auth Bypass Vulnerability

CVE-2025-62754 Overview

CVE-2025-62754 is a missing authorization vulnerability in the Kapil Paul Payment Gateway bKash for WC plugin (woo-payment-bkash) for WordPress. The flaw affects all versions up to and including 3.1.0. Unauthenticated attackers can exploit incorrectly configured access control security levels to invoke plugin functionality without proper permission checks. The vulnerability is tracked under CWE-862: Missing Authorization and is reachable over the network without user interaction.

Critical Impact
Remote attackers can interact with plugin endpoints that should enforce authorization, leading to limited integrity impact on WooCommerce stores using bKash payment integration.

Affected Products

Kapil Paul Payment Gateway bKash for WC (woo-payment-bkash) WordPress plugin
All versions from initial release through 3.1.0
WooCommerce installations integrating bKash payment processing

Discovery Timeline

2026-01-22 - CVE-2025-62754 published to NVD
2026-04-27 - Last updated in NVD database

Technical Details for CVE-2025-62754

Vulnerability Analysis

The Payment Gateway bKash for WC plugin exposes functionality that fails to verify whether a requesting user holds the required capability or role. WordPress plugins are expected to gate sensitive actions using current_user_can() checks, nonce validation, and capability mapping. This plugin omits one or more of those access control layers on at least one endpoint.

An unauthenticated remote attacker can send crafted HTTP requests to the affected endpoint and trigger plugin actions that should be restricted. The Patchstack advisory classifies this as a broken access control issue affecting versions up to 3.1.0. The resulting impact is limited to integrity, with no direct confidentiality or availability consequences reported.

Root Cause

The root cause is a missing authorization check (CWE-862) on plugin handlers. The plugin registers callable actions that execute without confirming the caller has appropriate permissions. The advisory describes this as "Exploiting Incorrectly Configured Access Control Security Levels," indicating the access control logic exists but is configured at an insufficient security tier.

Attack Vector

Exploitation occurs over the network. An attacker submits HTTP requests directly to the WordPress site hosting the vulnerable plugin. No authentication, privileges, or user interaction are required. The attacker targets the plugin's AJAX or REST endpoints that lack proper capability verification. Refer to the Patchstack Vulnerability Report for endpoint-level technical details.

Detection Methods for CVE-2025-62754

Indicators of Compromise

Unexpected HTTP POST or GET requests to woo-payment-bkash plugin endpoints from unauthenticated sources
WordPress access logs showing requests to admin-ajax.php or REST routes referencing bKash actions without an authenticated session cookie
Unexplained modifications to bKash gateway configuration or transaction records in WooCommerce

Detection Strategies

Audit the WordPress plugin inventory for woo-payment-bkash at version 3.1.0 or earlier
Inspect web server access logs for anomalous request patterns targeting plugin-specific query parameters or action names
Compare WooCommerce order metadata against expected bKash transaction states to identify unauthorized changes

Monitoring Recommendations

Forward WordPress and web server logs to a centralized log analytics platform for query and correlation
Alert on high-volume unauthenticated requests reaching /wp-admin/admin-ajax.php with bKash-related action parameters
Monitor plugin file integrity and configuration drift on production WooCommerce hosts

How to Mitigate CVE-2025-62754

Immediate Actions Required

Identify all WordPress sites running woo-payment-bkash and confirm the installed version
Update the plugin to a version newer than 3.1.0 once the vendor publishes a patched release
Restrict administrative and AJAX endpoints behind a web application firewall (WAF) until patching is complete

Patch Information

At the time of NVD publication, the advisory lists affected versions as "from n/a through <= 3.1.0." Administrators should consult the Patchstack Vulnerability Report for the current patched version and apply it through the WordPress plugin updater.

Workarounds

Disable the woo-payment-bkash plugin if bKash payment processing is not actively required
Apply WAF rules that block unauthenticated requests to plugin-specific endpoints
Restrict access to the WordPress admin and AJAX surfaces by IP allowlist where operationally feasible

bash

# Configuration example: list and deactivate the vulnerable plugin via WP-CLI
wp plugin list --name=woo-payment-bkash --fields=name,status,version
wp plugin deactivate woo-payment-bkash