CVE-2025-15511: 
WordPress vulnerability analysis and mitigation

CVE-2025-15511 is a missing authorization vulnerability in the Rupantorpay plugin for WordPress that allows unauthenticated attackers to modify WooCommerce order statuses. The flaw exists in all versions up to and including 2.0.0, and was disclosed on January 28, 2026. It carries a CVSS v3.1 base score of 5.3 (Medium), assigned by Wordfence (Wordfence, Red Hat CVE).

The root cause is a missing capability check (CWE-862: Missing Authorization) on the handle_webhook() function within the plugin's WooCommerce gateway class (includes/class-wc-rupantorpay-gateway.php, line 172). Because no authentication or authorization is enforced before processing incoming webhook requests, any unauthenticated remote attacker can send crafted HTTP requests to the WooCommerce API endpoint and trigger order status changes. No special privileges, user interaction, or complex conditions are required for exploitation (Wordfence, WordPress Trac).

Successful exploitation allows unauthenticated attackers to arbitrarily modify WooCommerce order statuses, which can result in fraudulent order fulfillment (e.g., marking unpaid orders as completed), financial loss for merchants, and corruption of order data integrity. There is no direct confidentiality or availability impact, but the integrity compromise of e-commerce transaction records can have significant business consequences for affected WordPress/WooCommerce store operators (Wordfence, Red Hat CVE).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported. The EPSS score is approximately 0.038%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (Wordfence).

1. Reconnaissance: Identify WordPress sites using the Rupantorpay plugin (version ≤ 2.0.0) via passive scanning, WordPress plugin enumeration tools, or public search engines.
2. Locate the webhook endpoint: Identify the WooCommerce API endpoint registered by the Rupantorpay plugin that invokes the handle_webhook() function (typically a REST API or WooCommerce webhook URL registered by the plugin).
3. Craft a malicious request: Construct an HTTP POST request to the identified webhook endpoint with a payload that specifies a target WooCommerce order ID and a desired order status (e.g., completed, processing).
4. Send the unauthenticated request: Submit the crafted request without any authentication headers or credentials, exploiting the missing capability check.
5. Verify impact: Confirm that the targeted WooCommerce order status has been modified as specified, achieving unauthorized data manipulation (Wordfence, WordPress Trac).

• Network: Unexpected or repeated unauthenticated POST requests to the Rupantorpay webhook endpoint (WooCommerce API route registered by the plugin) from unknown or external IP addresses.
• Logs: WordPress/WooCommerce access logs showing POST requests to the plugin's webhook URL without valid authentication tokens or nonces, especially from unfamiliar sources.
• Application: Unexplained changes to WooCommerce order statuses (e.g., orders marked as completed or processing without corresponding payment confirmation or admin action).

Users should update the Rupantorpay plugin to version 2.0.1 or later, which addresses the missing capability check on the handle_webhook() function. As an interim workaround, site administrators can deactivate or remove the plugin until the update can be applied. Additionally, implementing a web application firewall (WAF) rule to restrict unauthenticated access to the plugin's webhook endpoint can reduce exposure (Wordfence).

Wordfence disclosed and reported this vulnerability as part of their weekly WordPress vulnerability report for the period of January 26–February 1, 2026, noting the patch availability in version 2.0.1 (Wordfence Blog). No significant broader media coverage or notable researcher commentary beyond the initial Wordfence disclosure has been identified.