CVE-2025-63015: 
WordPress vulnerability analysis and mitigation

CVE-2025-63015 is a Missing Authorization (Broken Access Control) vulnerability in the WooCommerce Payment Gateway – Paysera WordPress plugin (woo-payment-gateway-paysera). It affects all versions up to and including 3.10.0, allowing authenticated attackers with low privileges (Subscriber-level) to exploit incorrectly configured access control security levels. The vulnerability was reported on November 4, 2025, by researcher Legion Hunter and published on December 4–9, 2025. It carries a CVSS v3.1 base score of 4.3 (Medium) (Patchstack).

The vulnerability is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly verify whether a requesting user has the necessary permissions before executing certain privileged actions. An authenticated attacker with Subscriber-level access can send crafted network requests to trigger functionality that should be restricted to higher-privileged roles (e.g., administrators). No complex conditions or user interaction are required beyond having a low-privilege account on the affected WordPress site (Patchstack).

Successful exploitation results in a limited integrity impact — an attacker can perform unauthorized actions that should be restricted to higher-privileged users, but there is no confidentiality or availability impact. The scope is limited to the affected WordPress installation running the vulnerable plugin. While the severity is low, exploitation could allow manipulation of payment gateway settings or other plugin-controlled functionality, potentially disrupting e-commerce operations on affected sites (Patchstack).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of exploitation in the near term. The vulnerability requires an authenticated low-privilege account (Subscriber level), which limits opportunistic exploitation. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack notes that vulnerabilities of this class can be used in mass-exploit campaigns targeting WordPress sites at scale (Patchstack).

1. Reconnaissance: Identify WordPress sites running the WooCommerce Payment Gateway – Paysera plugin version ≤ 3.10.0 using tools like WPScan or Shodan.
2. Obtain low-privilege access: Register or obtain a Subscriber-level account on the target WordPress site (e.g., via open user registration).
3. Identify unprotected endpoints: Enumerate plugin-specific AJAX actions or REST API endpoints that lack proper capability checks, which are the typical attack surface for CWE-862 in WordPress plugins.
4. Send unauthorized request: Craft and send an authenticated HTTP request (with valid nonce/session cookie) to the vulnerable endpoint, invoking a privileged action without the required authorization check.
5. Achieve unauthorized action: Successfully execute a higher-privileged operation (e.g., modifying payment gateway configuration) that should be restricted to administrators (Patchstack).

• Logs: WordPress access logs showing authenticated POST requests to plugin-specific AJAX endpoints (/wp-admin/admin-ajax.php) or REST API routes associated with woo-payment-gateway-paysera from Subscriber-level user accounts.
• Logs: Unexpected changes to WooCommerce payment gateway settings recorded in WordPress audit logs or database change logs.
• File System: Unexpected modifications to plugin configuration files or WooCommerce option entries in the wp_options table related to Paysera gateway settings.

The vendor has released version 3.11.0 of the WooCommerce Payment Gateway – Paysera plugin, which patches this vulnerability. Site administrators should update the plugin to version 3.11.0 or later immediately via the WordPress admin dashboard or by downloading the updated plugin. If an immediate update is not possible, consider disabling the plugin temporarily or restricting user registration to prevent untrusted Subscriber-level accounts. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard (Patchstack).