CVE-2025-14463: 
WordPress vulnerability analysis and mitigation

CVE-2025-14463 is a Missing Authorization vulnerability in the Payment Button for PayPal WordPress plugin (also known as wp-paypal) that allows unauthenticated attackers to create arbitrary orders without any real PayPal transaction. All versions up to and including 1.2.3.41 are affected. The vulnerability was reported by Wordfence and published on January 16–17, 2026. It carries a CVSS v3.1 base score of 5.3 (Medium), assigned by Wordfence (Wordfence, Red Hat CVE).

The root cause is CWE-862 (Missing Authorization): the plugin registers a public WordPress AJAX action (wppaypalcheckout_ajax_process_order) in wp-paypal.php (line 70) that is accessible to unauthenticated users via wp-admin/admin-ajax.php. The handler in wp-paypal-checkout.php (line 249) processes checkout results — including transaction ID, payment status, product name, amount, and customer information — without verifying that a legitimate PayPal transaction actually occurred or that the caller is authenticated. An attacker only needs to bypass basic parameter validation (e.g., supplying required POST fields) to have the plugin record a fully fabricated order in the WordPress database. If the site has email notifications enabled, the plugin will also dispatch purchase receipt emails to any attacker-supplied address (Wordfence, WP Trac – checkout.php).

Successful exploitation allows unauthenticated attackers to corrupt the site's order database by injecting arbitrary orders with fabricated payment details, undermining the integrity of all sales records. If email notifications are active, the plugin will send purchase confirmation emails to any address the attacker specifies, enabling spam or phishing abuse of the site's mail infrastructure. There is no confidentiality impact (no data is exposed to the attacker) and no direct availability impact, but the integrity of the e-commerce workflow is fully compromised for affected sites (Wordfence, Red Hat CVE).

No public exploit code or active in-the-wild exploitation has been reported as of the time of writing. The EPSS score is approximately 0.0022 (~0.22%), indicating a low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the attack requires no authentication and low complexity, making it trivially reachable by any internet-based attacker who identifies a vulnerable site (Wordfence, Red Hat CVE).

1. Reconnaissance: Identify WordPress sites running the Payment Button for PayPal plugin (wp-paypal) version ≤ 1.2.3.41 using tools like WPScan, Shodan, or by checking /wp-content/plugins/wp-paypal/readme.txt for the version number.
2. Locate the AJAX endpoint: The vulnerable endpoint is the standard WordPress AJAX handler at https://<target>/wp-admin/admin-ajax.php, which is publicly accessible without authentication.
3. Craft a malicious POST request: Send a POST request to the AJAX endpoint with the action parameter set to wppaypalcheckout_ajax_process_order and supply arbitrary values for required fields such as transaction ID, payment status (e.g., Completed), product name, amount, and customer email/name.
4. Bypass parameter validation: Ensure all minimally required POST parameters are present to pass the plugin's basic validation checks (review source at wp-paypal-checkout.php#L249 for required fields).
5. Achieve objective: The plugin records a fabricated order in the WordPress database. If email notifications are enabled, a purchase receipt is sent to the attacker-supplied email address, and the order appears as legitimate in the site's admin panel (Wordfence, WP Trac – checkout.php).

• Network: Unexpected POST requests to /wp-admin/admin-ajax.php with action=wppaypalcheckout_ajax_process_order from unknown or automated IP addresses; high-frequency requests to this endpoint from a single source.
• Logs: Web server access logs showing repeated POST requests to admin-ajax.php with the above action parameter, especially with unusual or repeated transaction IDs; WordPress debug logs recording order creation events without corresponding PayPal IPN/webhook callbacks.
• Database: Orders in the WordPress orders table with transaction IDs that do not match any records in the PayPal merchant account; orders with suspicious payment statuses (e.g., Completed) for zero-value or unusually named products.
• Email: Outbound purchase confirmation emails sent to external or unknown addresses not associated with real customers, potentially flagged by mail server logs or email delivery services.

Site administrators should update the Payment Button for PayPal plugin to a version above 1.2.3.41 that includes server-side PayPal transaction verification. The fix is available in the plugin's trunk repository (see the changeset referenced by Wordfence). As an interim workaround, administrators can disable the plugin entirely or restrict access to wp-admin/admin-ajax.php for unauthenticated users via WAF rules or server configuration, though this may affect other plugin functionality. Disabling email notifications for orders can also limit the spam/phishing abuse vector until a patch is applied (Wordfence, WP Trac – changeset).

The vulnerability was discovered and disclosed by Wordfence, which published the advisory on January 17, 2026. Coverage has been limited to automated vulnerability aggregators and security databases (VulDB, Vulners, CIRCL, INCIBE), with no notable independent researcher commentary or significant social media discussion identified beyond a brief Bluesky post from a CVE tracking account.