CVE-2025-12355: 
WordPress vulnerability analysis and mitigation

CVE-2025-12355 is a Missing Authorization vulnerability in the Payaza plugin for WordPress that allows unauthenticated attackers to modify order statuses via an unprotected AJAX endpoint. It affects all versions of the Payaza plugin up to and including 0.3.8, developed by the vendor "bigmaster." The vulnerability was published on December 5, 2025, and was assigned by Wordfence. It carries a CVSS v3.1 base score of 5.3 (Medium) (Wordfence, Red Hat CVE).

The root cause is a missing capability check (CWE-862) on the wp_ajax_nopriv_update_order_status AJAX endpoint registered by the Payaza WordPress plugin. Because the endpoint uses the nopriv hook, it is accessible to unauthenticated users, and no authorization check is performed before processing the request. An attacker can send a crafted HTTP POST request to WordPress's admin-ajax.php with the action parameter set to update_order_status, manipulating WooCommerce or plugin-managed order records without any credentials or user interaction (Wordfence, ENISA EUVD).

Successful exploitation allows unauthenticated remote attackers to arbitrarily update order statuses on affected WordPress e-commerce sites, potentially marking unpaid orders as completed, canceling legitimate orders, or otherwise manipulating transaction states. This primarily affects data integrity, with no direct confidentiality or availability impact. The business impact can include financial loss, fraudulent order fulfillment, and disruption of payment workflows for merchants using the Payaza payment plugin (Wordfence, ENISA EUVD).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported as of the available data. The EPSS score is approximately 0.051% (0.000510), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (Wordfence).

1. Reconnaissance: Identify WordPress sites using the Payaza plugin (versions ≤ 0.3.8) via passive scanning, plugin enumeration tools (e.g., WPScan), or by checking publicly accessible readme.txt files at /wp-content/plugins/payaza/readme.txt.
2. Identify the vulnerable endpoint: Confirm the site exposes the wp_ajax_nopriv_update_order_status action by sending a test POST request to https://target.com/wp-admin/admin-ajax.php with action=update_order_status.
3. Craft the malicious request: Construct an HTTP POST request to admin-ajax.php with the required parameters to specify a target order ID and the desired new status (e.g., completed, processing).
4. Submit the request: Send the unauthenticated POST request. Because no capability check is enforced, the plugin processes the request and updates the order status in the database.
5. Verify impact: Confirm the order status change via the WordPress admin panel or by observing downstream effects such as order fulfillment notifications (Wordfence).

• Network: Unusual or repeated unauthenticated POST requests to /wp-admin/admin-ajax.php with the parameter action=update_order_status from unexpected IP addresses.
• Logs: WordPress or web server access logs showing POST requests to admin-ajax.php?action=update_order_status without a valid session cookie or nonce.
• Application: Unexpected changes to WooCommerce or Payaza-managed order statuses (e.g., orders marked as completed without corresponding payment confirmation); orders transitioning to paid/completed states without matching payment gateway callbacks.

Users should update the Payaza plugin to a version beyond 0.3.8 that includes a proper capability check on the update_order_status AJAX endpoint. If no patched version is yet available from the plugin author, site administrators should deactivate and remove the Payaza plugin until a fix is released. As an additional layer of defense, web application firewalls (WAFs) can be configured to block unauthenticated POST requests to admin-ajax.php with the update_order_status action (Wordfence, WordPress Plugin Page).