CVE-2025-14078: 
WordPress vulnerability analysis and mitigation

CVE-2025-14078 is a Missing Authorization vulnerability in the PAYGENT for WooCommerce WordPress plugin that allows unauthenticated attackers to manipulate payment callbacks and modify order statuses. It affects all versions of the plugin up to and including 2.4.6. The vulnerability was disclosed on January 17, 2026, with Wordfence as the assigning CNA. It carries a CVSS v3.1 base score of 5.3 (Medium) (Wordfence, Red Hat CVE).

The root cause is classified as CWE-862 (Missing Authorization). The vulnerability stems from two compounding flaws: the paygent_check_webhook function lacks proper authorization checks, and the paygent_permission_callback function unconditionally returns true at line 199 of class-wc-paygent-endpoint.php, effectively bypassing all access control for the REST API endpoint. An unauthenticated attacker can send forged HTTP POST requests to the /wp-json/paygent/v1/check/ endpoint to submit fraudulent payment notifications, causing the plugin to update WooCommerce order statuses as if legitimate payment confirmations were received (Wordfence, WordPress Trac).

Successful exploitation allows unauthenticated attackers to forge payment notifications and manipulate WooCommerce order statuses — for example, marking unpaid orders as paid — without completing an actual financial transaction. This directly threatens the integrity of e-commerce operations on affected WordPress sites, potentially enabling fraud such as obtaining goods or services without payment. There is no confidentiality or availability impact; the risk is confined to order data integrity (Wordfence, Red Hat CVE).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-14078. The EPSS score is approximately 0.055%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the attack requires no authentication, no user interaction, and no special privileges, making it trivially exploitable by any network-accessible attacker against unpatched sites (Wordfence, Red Hat CVE).

1. Reconnaissance: Identify WordPress sites using the PAYGENT for WooCommerce plugin (versions ≤ 2.4.6) by scanning for the REST API endpoint /wp-json/paygent/v1/check/ or by checking plugin metadata via /wp-json/wp/v2/plugins if accessible.
2. Identify target orders: Browse the target WooCommerce store to identify order IDs or product listings that correspond to pending/unpaid orders (order IDs may be guessable or discoverable via the storefront).
3. Craft forged payment notification: Construct an HTTP POST request to https://<target>/wp-json/paygent/v1/check/ with a payload mimicking a legitimate PAYGENT payment callback, including the target order ID and a status indicating successful payment.
4. Send the forged request: Submit the crafted request without any authentication headers. Because paygent_permission_callback unconditionally returns true, the request is accepted and processed by paygent_check_webhook.
5. Verify order status change: Confirm that the targeted WooCommerce order status has been updated to a paid/completed state, enabling the attacker to claim goods or services without actual payment (Wordfence, WordPress Trac).

• Network: Unexpected or repeated HTTP POST requests to /wp-json/paygent/v1/check/ from IP addresses not associated with the PAYGENT payment gateway infrastructure; requests originating from unusual geographic locations or automated tools.
• Logs: WordPress/WooCommerce access logs showing POST requests to the PAYGENT webhook endpoint from unauthenticated sources; order status change events in WooCommerce logs that do not correspond to legitimate payment gateway callbacks.
• Application: WooCommerce orders transitioning to paid/completed status without corresponding entries in the PAYGENT payment gateway transaction records or bank statements; discrepancies between order revenue and actual payment receipts.

Site administrators should update the PAYGENT for WooCommerce plugin to version 2.4.7 or later, which addresses the missing authorization flaw. The fix was introduced in changesets 3432342 and 3433179 in the WordPress plugin repository. As an interim measure, administrators unable to update immediately should consider disabling the plugin or restricting access to the /wp-json/paygent/v1/check/ endpoint via web server rules (e.g., allowlisting only PAYGENT gateway IP addresses) (Wordfence, WordPress Trac Changeset).