CVE-2025-12355 is a missing authorization vulnerability (CWE-862) in the Payaza WordPress plugin by bigmaster. The issue exists because the AJAX endpoint 'wp_ajax_nopriv_update_order_status' does not perform capability checks, allowing unauthenticated users to update order statuses. This affects all versions up to 0.3.8. The vulnerability has a CVSS 3.1 base score of 5.3, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and no availability impact. No known exploits in the wild or patches are currently documented.

An unauthenticated attacker can modify order statuses in the Payaza plugin, potentially disrupting order processing or causing incorrect order information. There is no direct confidentiality or availability impact reported. The integrity of order data is affected, which could lead to business process issues or fraud.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected AJAX endpoint if possible or implement custom authorization checks. Monitor for updates from the vendor bigmaster regarding patches or official mitigations.