CVE-2025-11728 is a vulnerability in the Oceanpayment CreditCard Gateway WordPress plugin caused by missing authentication and capability checks on the 'return_payment' and 'notice_payment' functions. This flaw enables unauthenticated attackers to update WooCommerce orders to a 'failed' status and modify transaction IDs, potentially disrupting payment processing integrity. The issue affects all versions up to and including 6.0. The CVSS 3.1 base score is 5.3 (medium), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and impact limited to integrity loss without confidentiality or availability impact. No patch or official fix has been documented yet.

An attacker without authentication can modify WooCommerce order statuses to 'failed' and alter transaction IDs, which could disrupt order processing and payment reconciliation. There is no impact on confidentiality or availability according to the CVSS vector. This could lead to business process disruption or financial reconciliation issues but does not directly expose sensitive data or cause denial of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting access to the affected plugin's endpoints via web application firewall rules or other access controls to prevent unauthenticated requests to 'return_payment' and 'notice_payment' functions. Monitor for updates from the vendor and apply patches promptly once released.