CVE-2025-14978: 
WordPress vulnerability analysis and mitigation

CVE-2025-14978 is a Missing Authorization vulnerability in the PeachPay — Payments & Express Checkout for WooCommerce WordPress plugin that allows unauthenticated attackers to modify the status of arbitrary WooCommerce orders. The flaw affects all versions of the plugin up to and including 1.119.8, and was published on January 19–20, 2026, with the CVE record received from Wordfence. It carries a CVSS v3.1 base score of 5.3 (Medium), assigned by Wordfence (Wordfence).

The root cause is a missing capability check (CWE-862) on the ConvesioPay webhook REST endpoint within the PeachPay plugin, specifically in the class-peachpay-convesiopay-webhook.php file at line 33. Because the REST endpoint does not verify that the requester has appropriate permissions, any unauthenticated network attacker can send crafted HTTP requests to this endpoint and manipulate WooCommerce order statuses without any credentials or user interaction. No authentication or elevated privileges are required, and the attack complexity is low (Wordfence, Plugin Source).

Successful exploitation allows unauthenticated attackers to arbitrarily modify the status of any WooCommerce order on affected stores — for example, marking unpaid orders as completed or canceling legitimate orders. This directly undermines order integrity and payment processing workflows, potentially enabling fraud such as obtaining goods or services without payment. There is no confidentiality or availability impact reported; the risk is confined to data integrity within the WooCommerce order management system (Wordfence).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2025-14978 as of the available data. The EPSS score is approximately 0.041%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The attack requires no authentication and no user interaction, making it trivially exploitable if targeted, but the limited impact scope may reduce attacker motivation (Wordfence).

1. Reconnaissance: Identify WordPress sites running the PeachPay plugin (versions ≤ 1.119.8) using tools like WPScan, Shodan, or by inspecting publicly accessible plugin metadata in the WordPress plugin directory.
2. Locate the vulnerable endpoint: Identify the ConvesioPay webhook REST API endpoint exposed by the plugin (e.g., a REST route registered under /wp-json/peachpay/... or similar, as implemented in class-peachpay-convesiopay-webhook.php).
3. Craft a malicious request: Send an unauthenticated HTTP POST request to the webhook endpoint with a payload specifying a target WooCommerce order ID and the desired order status (e.g., completed, cancelled).
4. Achieve unauthorized order modification: Because no capability check is performed, the server processes the request and updates the specified order's status, enabling fraud such as marking unpaid orders as fulfilled (Wordfence, Plugin Source).

• Network: Unexpected or repeated unauthenticated POST requests to the PeachPay ConvesioPay webhook REST endpoint (e.g., /wp-json/peachpay/ or related paths) from unknown or suspicious IP addresses.
• Logs: WordPress/WooCommerce access logs showing REST API calls to the ConvesioPay webhook route without associated authentication tokens or nonces; order status change events in WooCommerce logs that do not correspond to legitimate customer or admin actions.
• Application: Unexplained WooCommerce order status changes (e.g., orders moving to completed or cancelled without corresponding payment events or admin activity).

Store owners should update the PeachPay plugin to a version beyond 1.119.8 that includes a fix for the missing capability check on the ConvesioPay webhook REST endpoint. Until a patched version is available or applied, consider disabling the PeachPay plugin or restricting access to WordPress REST API endpoints via a web application firewall (WAF) or server-level rules. Regularly audit WooCommerce order status changes for anomalies as a compensating control (Wordfence).

The vulnerability was discovered and reported by Wordfence, which published the threat intelligence entry and submitted the CVE record. No significant broader media coverage, vendor statements beyond the CVE record, or notable researcher commentary has been identified for this vulnerability.