CVE-2025-12883 is an authorization bypass vulnerability classified under CWE-639 affecting the Campay Woocommerce Payment Gateway plugin for WordPress. The issue exists in all versions up to and including 1.2.2, where the plugin fails to verify that a payment transaction was legitimately processed. This allows unauthenticated attackers to manipulate order status, marking orders as paid without completing a transaction. The CVSS 3.1 base score is 5.3 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and no availability impact. No patches or official fixes are currently documented for this vulnerability.

Successful exploitation enables unauthenticated attackers to bypass payment processing and mark orders as completed, resulting in potential financial loss due to unpaid orders being accepted as paid. There is no direct impact on confidentiality or availability, but the integrity of order payment status is compromised.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling the Campay Woocommerce Payment Gateway plugin or implementing additional manual verification controls for order payments to prevent unauthorized order completion.