CVE-2025-14971: 
WordPress vulnerability analysis and mitigation

CVE-2025-14971 is a Missing Authorization vulnerability in the Link Invoice Payment for WooCommerce WordPress plugin that allows unauthenticated attackers to create or cancel partial payments on any order via ID enumeration. It affects all versions up to and including 2.8.0. The vulnerability was published on January 27, 2026, and was discovered and reported by Wordfence. It carries a CVSS v3.1 base score of 5.3 (Medium) (Wordfence, Red Hat CVE).

The root cause is a missing capability check (CWE-862) on the createPartialPayment and cancelPartialPayment functions within WcPaymentInvoiceEndpoint.php. Because no authentication or authorization is enforced before these functions execute, any unauthenticated network request can trigger them. Attackers exploit this by enumerating order IDs and sending crafted requests to create fraudulent partial payments or cancel legitimate ones on arbitrary WooCommerce orders (Wordfence, WordPress Plugin Trac).

Successful exploitation allows unauthenticated attackers to manipulate payment records on any WooCommerce order — either fabricating partial payments to fraudulently mark orders as (partially) paid, or canceling legitimate partial payments to disrupt order fulfillment. The primary impact is on data integrity and financial record accuracy; there is no confidentiality or availability impact. This could result in financial losses for merchants, order processing disruptions, and potential fraud (Wordfence).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.015% (0.000150), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The attack requires no authentication and no user interaction, making it trivially exploitable if targeted, but the limited impact scope reduces attacker incentive (Wordfence, Red Hat CVE).

1. Reconnaissance: Identify WordPress sites running the Link Invoice Payment for WooCommerce plugin (version ≤ 2.8.0) using tools like WPScan or by checking publicly accessible plugin metadata at /wp-content/plugins/invoice-payment-for-woocommerce/.
2. Order ID Enumeration: Enumerate WooCommerce order IDs by iterating through sequential integer values, as WooCommerce order IDs are typically sequential and predictable.
3. Craft Malicious Request: Send an unauthenticated HTTP request to the plugin's REST API or AJAX endpoint invoking createPartialPayment or cancelPartialPayment, supplying a valid order ID as a parameter — no authentication token or nonce is required due to the missing capability check.
4. Achieve Objective: Successfully create a fraudulent partial payment record on a target order (potentially marking it as partially paid without actual payment), or cancel an existing legitimate partial payment to disrupt order processing (Wordfence, WordPress Plugin Trac).

• Network: Unusual unauthenticated HTTP POST requests to WooCommerce REST API or WordPress AJAX endpoints (/wp-admin/admin-ajax.php or /wp-json/) invoking createPartialPayment or cancelPartialPayment actions from unexpected IP addresses.
• Logs: WordPress/WooCommerce access logs showing repeated requests with sequential order ID parameters from a single IP, suggesting enumeration activity; requests lacking authentication cookies or nonces.
• Application: Unexpected partial payment records appearing on WooCommerce orders without corresponding payment gateway transactions; legitimate partial payments being canceled without merchant action.

Update the Link Invoice Payment for WooCommerce plugin to version 2.8.1 or later, which introduces the required capability checks on the affected functions. No configuration-based workaround is available for unpatched versions; the only effective mitigation is upgrading the plugin. Site administrators should also audit recent WooCommerce order payment records for unexpected partial payment creation or cancellation activity (Wordfence, Wordfence Weekly Report).

Wordfence disclosed the vulnerability as part of their weekly WordPress vulnerability intelligence report for the week of January 26–February 1, 2026, noting the patch availability in version 2.8.1. No significant broader media coverage or notable researcher commentary beyond the Wordfence advisory has been identified (Wordfence Weekly Report).