CVE-2025-14843 is a missing authorization vulnerability (CWE-862) in the Wizit Gateway for WooCommerce plugin for WordPress. The flaw exists in the 'handle_checkout_redirecturl_response' function, which lacks proper authentication and authorization checks. This allows unauthenticated attackers to send crafted requests containing valid order IDs to cancel arbitrary WooCommerce orders. The vulnerability affects all versions up to and including 1.2.9. The CVSS 3.1 base score is 5.3, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. No patch or vendor advisory is available to confirm remediation status.

An unauthenticated attacker can cancel arbitrary orders in WooCommerce using the Wizit Gateway plugin, potentially disrupting order processing and causing denial of service to legitimate customers. There is no confidentiality or availability impact reported, only integrity impact due to unauthorized order cancellation. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to the affected function or plugin, or disabling the Wizit Gateway plugin if feasible to prevent exploitation.