CVE-2025-14880 is a missing authorization vulnerability (CWE-862) in the Netcash WooCommerce Payment Gateway plugin for WordPress. Specifically, the handle_return_url function lacks a capability check, enabling unauthenticated attackers to change the status of any WooCommerce order to processing or completed. This vulnerability affects all versions up to and including 4.1.3. The CVSS 3.1 base score is 5.3, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. No patch or official fix has been documented in the provided data.

An attacker without authentication can modify the status of WooCommerce orders to processing or completed. This could lead to business logic abuse such as unauthorized order fulfillment or financial discrepancies. There is no direct confidentiality or availability impact reported. No known exploits have been observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected plugin and monitor for suspicious order status changes. Avoid relying solely on this plugin for critical order status updates.