CVE-2025-14460: 
WordPress vulnerability analysis and mitigation

CVE-2025-14460 is a missing authorization vulnerability in the Piraeus Bank WooCommerce Payment Gateway plugin for WordPress that allows unauthenticated attackers to modify any order's status to 'failed'. All plugin versions up to and including 3.1.4 are affected. The vulnerability was disclosed on January 7, 2026, by Wordfence, and carries a CVSS v3.1 base score of 5.3 (Medium) (Wordfence).

The root cause is classified as CWE-862 (Missing Authorization). The plugin's payment callback endpoint handler — responsible for processing 'fail' callbacks from the Piraeus Bank payment gateway — does not perform any authorization checks before acting on the request. An unauthenticated attacker can send a crafted HTTP request to the publicly accessible WooCommerce API endpoint, supplying only the MerchantReference parameter (the order ID), which is trivially enumerable because WooCommerce order IDs are sequential integers. The vulnerable code is located in WC_Piraeusbank_Gateway.php at approximately line 821 (Wordfence, Plugin Source).

Successful exploitation allows any unauthenticated attacker to set any WooCommerce order to a 'failed' status, causing significant business disruption. Consequences include canceled shipments, inventory management issues, and direct revenue loss for affected merchants. There is no confidentiality or availability impact; the vulnerability is limited to integrity of order data, but the business impact can be severe for e-commerce operators relying on the plugin (Wordfence).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the available data. The EPSS score is approximately 0.034%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the attack requires no authentication, no special privileges, and no user interaction, and the target parameter (order ID) is easily enumerable, making the barrier to exploitation very low (Wordfence).

1. Reconnaissance: Identify WordPress sites using the Piraeus Bank WooCommerce Payment Gateway plugin (version ≤ 3.1.4) via passive scanning, plugin enumeration tools, or by checking publicly visible plugin metadata.
2. Enumerate order IDs: Since WooCommerce order IDs are sequential integers, begin with low integers (e.g., 1, 2, 3, ...) and increment to enumerate valid order IDs.
3. Craft the malicious request: Send an HTTP request to the publicly accessible WooCommerce API callback endpoint used by the plugin for 'fail' payment callbacks, supplying the target order ID as the MerchantReference parameter.
4. Trigger order status change: The plugin processes the unauthenticated 'fail' callback without authorization checks, updating the targeted order's status to 'failed' in the WooCommerce database.
5. Repeat for disruption: Iterate over a range of order IDs to mass-cancel orders, causing widespread business disruption to the targeted merchant (Wordfence, Plugin Source).

• Network: Repeated HTTP POST/GET requests to the WooCommerce payment callback endpoint (associated with the Piraeus Bank gateway) from a single or rotating IP address, especially with sequentially incrementing MerchantReference values.
• Logs: WordPress/WooCommerce access logs showing a high volume of requests to the Piraeus Bank callback URL path with varying numeric MerchantReference parameters in a short time window.
• Application: Sudden spike in WooCommerce orders transitioning to 'failed' status, particularly across a broad range of order IDs and without corresponding legitimate payment gateway activity.

A patch was released in plugin changeset 3439515, which adds proper authorization checks to the payment callback endpoint. Administrators should update the Piraeus Bank WooCommerce Payment Gateway plugin to the version released after 3.1.4 immediately. As a temporary workaround, site administrators can restrict access to the WooCommerce callback endpoint via web server rules (e.g., IP allowlisting to known Piraeus Bank gateway IPs) until the plugin can be updated (Plugin Changeset, Wordfence).