CVE-2025-67942: 
WordPress vulnerability analysis and mitigation

CVE-2025-67942 is a Missing Authorization (Broken Access Control) vulnerability in the Peach Payments Gateway WordPress plugin (wc-peach-payments-gateway), affecting all versions up to and including 3.3.6. It was reported by researcher Legion Hunter on October 28, 2025, and published by Patchstack on January 16–22, 2026. The vulnerability allows unauthenticated remote attackers to exploit incorrectly configured access control security levels. It carries a CVSS v3.1 base score of 6.5 (Medium), as assigned by Patchstack (Patchstack).

The vulnerability is classified as CWE-862 (Missing Authorization), meaning the plugin fails to perform adequate authorization checks before executing certain privileged actions. Specifically, a missing or improperly enforced nonce token or capability check in one or more plugin functions allows unauthenticated users to trigger actions that should be restricted to higher-privileged roles. This falls under OWASP Top 10 category A1: Broken Access Control. No detailed technical write-up or public proof-of-concept code has been published beyond the Patchstack advisory (Patchstack).

Successful exploitation allows an unauthenticated attacker to perform unauthorized actions on affected WordPress sites running the Peach Payments Gateway plugin, resulting in limited integrity and availability impacts (CVSS v3.1: I:L, A:L per Patchstack's updated scoring). This could include manipulating payment gateway settings or triggering restricted plugin functionality without valid credentials. While the scope is unchanged and confidentiality impact is assessed as none, the ability to interfere with payment processing logic on e-commerce sites poses a meaningful business risk (Patchstack).

The vulnerability requires no authentication and no user interaction, making it trivially exploitable over the network with low attack complexity. Patchstack notes that vulnerabilities of this type are commonly used in mass-exploit campaigns targeting thousands of WordPress sites regardless of their traffic or popularity. The EPSS score is approximately 0.017% (0.000170), indicating a currently low but non-negligible probability of exploitation. No in-the-wild exploitation, threat actor attribution, or CISA KEV catalog listing has been reported as of the available data (Patchstack).

The vulnerability is patched in Peach Payments Gateway version 3.3.7. Site administrators should update the plugin to version 3.3.7 or later immediately. If an immediate update is not possible, Patchstack has issued a virtual patching/mitigation rule for its subscribers to block exploitation attempts until the plugin is updated. Contacting a hosting provider or web developer for assistance with the update is recommended if self-service is not feasible (Patchstack).