CVE-2025-12903 is an authorization bypass vulnerability in the Payment Plugins Braintree For WooCommerce plugin for WordPress. The vulnerability arises because the REST API endpoint wc-braintree/v1/3ds/vaulted_nonce is registered with a permission callback that always returns true, effectively disabling authorization checks. This allows unauthenticated attackers to supply token IDs and retrieve payment method nonces without verifying ownership or authentication. These nonces can then be used to perform fraudulent transactions, charge customer credit cards, or attach payment methods to other subscriptions. The issue affects all versions up to and including 3.2.78.

An attacker can exploit this vulnerability without authentication to retrieve payment method nonces associated with any stored payment token in the system. This can lead to fraudulent transactions, unauthorized charges on customer credit cards, or unauthorized attachment of payment methods to subscriptions. The vulnerability compromises the confidentiality and integrity of payment data but does not affect availability. The CVSS 3.1 base score is 7.5 (High), reflecting the network attack vector, low attack complexity, no privileges required, and high impact on confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected REST API endpoint by implementing custom permission checks or disabling the endpoint if not required. Monitor for updates from the vendor and apply patches promptly once released.