CVE-2025-14294: 
WordPress vulnerability analysis and mitigation

CVE-2025-14294 is a missing authentication vulnerability in the Razorpay for WooCommerce plugin for WordPress that allows unauthenticated attackers to modify order contact information. The flaw affects all versions of the plugin up to and including 4.7.8. It was published on February 19, 2026, and carries a CVSS v3.1 base score of 5.3 (Medium) (Red Hat CVE).

The root cause is a broken permission callback in the plugin's REST API: the checkAuthCredentials() function, used as the permission callback for the getCouponList() endpoint, unconditionally returns true, effectively bypassing all authentication checks (CWE-306: Missing Authentication for Critical Function). Because no capability check is enforced, any unauthenticated network request can reach the endpoint. An attacker who knows or can guess a WooCommerce order ID can send a crafted request to modify the billing and shipping contact details (email and phone number) associated with that order (Red Hat CVE).

Successful exploitation allows an unauthenticated remote attacker to tamper with the billing and shipping contact information (email address and phone number) of any WooCommerce order, impacting data integrity. While confidentiality and availability are not directly affected, order hijacking could facilitate fraud, redirect order communications, or disrupt customer notifications. The scope is limited to WooCommerce order metadata on sites running the vulnerable plugin (Red Hat CVE).

No public proof-of-concept exploit code or active in-the-wild exploitation has been reported as of the available data. The EPSS score is approximately 0.091%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires only knowledge or enumeration of a valid WooCommerce order ID, which lowers the practical barrier for opportunistic attackers (Red Hat CVE).

1. Reconnaissance: Identify WordPress sites running the Razorpay for WooCommerce plugin (versions ≤ 4.7.8) via HTTP response headers, plugin enumeration tools (e.g., WPScan), or public plugin directories.
2. Order ID enumeration: Guess or enumerate WooCommerce order IDs, which are typically sequential integers (e.g., starting from 1 and incrementing), by probing the target site or leveraging any publicly exposed order confirmation pages.
3. Craft malicious request: Send an unauthenticated HTTP request to the plugin's REST API endpoint that invokes the getCouponList() function, including the target order ID and desired replacement contact values (email and/or phone) as parameters.
4. Modify order data: Because checkAuthCredentials() returns true unconditionally, the server processes the request without authentication and updates the billing/shipping contact information for the specified order.
5. Achieve objective: The attacker can redirect order communications (e.g., confirmation emails, shipping notifications) to an address they control, facilitating fraud or social engineering against the merchant or customer (Red Hat CVE).

• Network: Unauthenticated HTTP POST/GET requests to the Razorpay WooCommerce plugin REST API endpoint (e.g., /wp-json/razorpay/v1/getCouponList or similar) from unexpected or anonymous sources.
• Logs: WordPress or web server access logs showing repeated requests to the plugin's REST API endpoint without valid authentication tokens or nonces, particularly with varying order ID parameters.
• Application: WooCommerce order records showing unexpected changes to billing email or phone fields, especially for orders that have already been placed and confirmed.
• Process: Automated sequential requests to the REST endpoint suggesting order ID enumeration activity.

Site administrators should update the Razorpay for WooCommerce plugin to a version beyond 4.7.8 that includes a corrected checkAuthCredentials() permission callback. Until a patched version is available or applied, consider disabling the plugin or restricting access to the WordPress REST API for unauthenticated users via a web application firewall (WAF) rule or server-level configuration. Monitoring WooCommerce order records for unexpected contact information changes is also recommended as a detective control (Red Hat CVE).