CVE-2025-14978 is a vulnerability classified under CWE-862 (Missing Authorization) affecting the PeachPay — Payments & Express Checkout plugin for WooCommerce, which integrates multiple payment gateways including Stripe, PayPal, Square, and Authorize.net. The vulnerability exists because the ConvesioPay webhook REST endpoint lacks proper capability checks, allowing unauthenticated attackers to send crafted requests that modify the status of any WooCommerce order. This flaw affects all versions up to and including 1.119.8. The vulnerability does not expose confidential data or disrupt service availability but compromises the integrity of order data by enabling unauthorized status changes. The CVSS v3.1 score is 5.3 (medium), reflecting the ease of exploitation (network vector, no privileges or user interaction required) but limited impact scope (integrity only). No public exploits have been reported yet, but the vulnerability poses a risk to e-commerce operations relying on PeachPay for payment processing. The missing authorization check is a critical security oversight in the webhook handling logic, which should enforce strict validation of incoming requests to ensure they originate from trusted sources and authorized users.

The primary impact of this vulnerability is unauthorized modification of WooCommerce order statuses, which can lead to financial discrepancies, fraudulent order processing, or disruption of order fulfillment workflows. Attackers could potentially mark unpaid orders as paid or vice versa, manipulate refunds, or alter shipment statuses, undermining trust in the e-commerce platform. While confidentiality and availability are not directly affected, the integrity compromise can result in significant operational and reputational damage for merchants. Organizations relying on PeachPay for payment processing may face increased risk of fraud, customer disputes, and financial losses. The vulnerability could also be leveraged as part of a larger attack chain targeting e-commerce infrastructure. Given WooCommerce's widespread adoption globally, the impact could be substantial if exploited at scale.

To mitigate this vulnerability, organizations should immediately update the PeachPay plugin to a patched version once available that includes proper authorization checks on the ConvesioPay webhook endpoint. Until a patch is released, administrators should implement network-level restrictions to limit access to the webhook endpoint only to trusted IP addresses associated with payment gateways. Additionally, enabling logging and monitoring of webhook requests can help detect suspicious activity. Implementing application-level validation such as verifying webhook signatures or tokens provided by payment processors can further prevent unauthorized requests. Regularly auditing plugin configurations and access controls, and applying the principle of least privilege to REST API endpoints, will reduce exposure. Organizations should also educate their security teams and developers about the risks of missing authorization checks in webhook integrations.